CVE-2026-16071 is a vulnerability in the LDAP storage provider component of Red Hat build of Keycloak 26.4. The flaw occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system permits lookups for users outside the configured LDAP search boundary. This results in the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into the local Keycloak storage. The root cause is the lack of validation ensuring the requested LDAP DN falls within the configured search boundary. The vulnerability requires delegated administrative privileges to exploit and has been assessed by Red Hat as moderate severity with a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Red Hat has published a security advisory and released an updated package (Keycloak 26.4.14) that includes a fix for this issue.

Successful exploitation allows an attacker with delegated administrative privileges to disclose user account details from unauthorized LDAP organizational units (OUs) outside the configured search boundary. Additionally, it can cause unintended importing of these unauthorized users into the local Keycloak storage. This may lead to information disclosure and potential integrity issues within the local user database. The vulnerability does not impact availability and requires low privileges (delegated admin) but no user interaction.

Red Hat has released an updated package, Red Hat build of Keycloak 26.4.14, which includes a fix for this vulnerability. Users should apply this security update to remediate the issue. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. There is no indication that any other mitigations or workarounds are available or required. Patch status is confirmed by the vendor advisory.