{"schemaVersion":3,"id":"CVE-2026-9083","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A flaw was found in Keycloak. A realm administrator with the \"manage-realm\" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.","dates":{"published":"2026-06-25T16:17:49.969Z","modified":"2026-06-26T06:46:21.516Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0078,"percentile":0.55147,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0078},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0078,"percentile":0.55147}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0078,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0078,"percentile":0.55147}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"redhat","product":"build_of_keycloak","name":"build of keycloak","label":"build_of_keycloak","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 26.4, < 26.4.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.6, < 26.6.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 26.4, < 26.4.13 | ≥ 26.6, < 26.6.4","eol":null,"hubHref":"/vendor/redhat/build_of_keycloak"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30049","label":"access.redhat.com/errata/RHSA-2026:30049","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","label":"access.redhat.com/errata/RHSA-2026:30050","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","label":"access.redhat.com/errata/RHSA-2026:30083","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","label":"access.redhat.com/errata/RHSA-2026:30084","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9083","label":"access.redhat.com/security/cve/CVE-2026-9083","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480168","label":"bugzilla.redhat.com/show_bug.cgi?id=2480168","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-06-25T16:17:49.969Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-26T06:46:21.516Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":20,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:45:51.585Z","stale":false,"partial":false}}