CVE-2026-16071: redhat build_of_keycloak LDAP Injection
Vulnerability summary
CVE-2026-16071 is a medium (CVSS 5.4) LDAP Injection vulnerability in redhat build_of_keycloak. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22.9% of scored vulnerabilities.
Timeline
- 05-08-2026PublishedVulnerability first disclosed.
- 31-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.09 pp
From 0.23% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Redhat1 product
- build_of_keycloak≥ 26.4, < 26.4.14 | ≥ 26.6, < 26.6.5
1 vendor · 1 product