CVE-2026-16071 is a vulnerability in the LDAP storage provider component of Red Hat Build of Keycloak, which federates user identities from external directories. The flaw occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, resulting in disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage. The root cause is the lack of validation ensuring that requested LDAP DNs fall within the configured search boundary. The vulnerability requires delegated administrative privileges to exploit and has been assessed by Red Hat as having moderate severity with a CVSS v3.1 base score of 5.4.

Successful exploitation allows an attacker with delegated administrative privileges to disclose user account details from unauthorized LDAP organizational units and causes unintended user imports into the local database. This can lead to information disclosure and potential unauthorized access to user data outside the intended LDAP scope. There is no impact on availability, and integrity impact is low.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16071 for current remediation guidance. Until a fix is available, restrict delegated administrative privileges to trusted users only to reduce risk. Monitor Red Hat advisories for updates on patches or mitigations.