Search: CVE-2026-19729

CVE-2026-19729 is a vulnerability in the key provider component of the Red Hat build of Keycloak 26.4. A previous fix for path probing was incomplete, allowing a realm administrator to submit arbitrary filesystem paths as keystore parameters. This flaw can be exploited to determine the existence and readability of files on the server, potentially exposing sensitive system information. The vulnerability has a CVSS score of 4.9 (medium severity). Red Hat has released updated images for Keycloak 26.4.16 and 26.6.7 that address this issue among other security fixes.