CVE-2026-0976— Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在输入验证错误漏洞，该漏洞源于输入验证不当，接受URL路径段中的RFC合规矩阵参数，可能导致远程攻击者绕过代理级路径过滤，暴露管理或敏感端点。
Affected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | any |
affected |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | any |
affected |
any |
affected | ||
any |
affected | ||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | any |
affected |
any |
affected | ||
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-0976
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Keycloak 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在输入验证错误漏洞，该漏洞源于输入验证不当，接受URL路径段中的RFC合规矩阵参数，可能导致远程攻击者绕过代理级路径过滤，暴露管理或敏感端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | - |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | - |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | - |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | - |
cpe:/a:redhat:jbosseapxp
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | - |
cpe:/a:redhat:jbosseapxp
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | - |
cpe:/a:redhat:jbosseapxp
|
|
II. Public POCs for CVE-2026-0976
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0976
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-0976 (2)
Same Patch Batch · Red Hat · 2026-01-15 · 4 CVEs total
| CVE-2026-0990 | 5.9 MEDIUM | Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing |
| CVE-2026-0989 | 3.7 LOW | Libxml2: unbounded relaxng include recursion leading to stack overflow |
| CVE-2026-0992 | 2.9 LOW | Libxml2: libxml2: denial of service via crafted xml catalogs |
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-109082
Keycloak-services: keycloak-services: ciba confidential-only -
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login pa -
CVE-2026-107623
Keycloak-services: keycloak-services: oidc dcr read-modify-w -
CVE-2026-107604
Keycloak-services: keycloak-services: view-clients role allo -
CVE-2026-107121
Keycloak-services: keycloak-services: smtp starttls plaintex
Same vendor: Red Hat
-
CVE-2026-89098
Nfs-utils: nfs-utils: denial of service via assertion failur -
CVE-2026-111581
Libblockdev: libblockdev: argument injection in ntfs/vfat la -
CVE-2026-111555
Luksmeta: missing slot-range validation permits out-of-gap d -
CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migra -
CVE-2026-105959
Spice-server: spice: heap buffer overflow via glz dictionary
Same weakness: CWE-20
-
CVE-2026-111374
FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rd -
CVE-2026-110916
Chrome Desktop <155.0.8059.84 输入验证漏洞致代码执行 -
CVE-2026-77466
Lychee: Webshop payment bypass via unrestricted "Dummy" gate -
CVE-2026-77470
Lychee: Webshop checkout lets the client override the paymen -
CVE-2026-100347
kin-openapi: Unauthenticated panic (DoS) in openapi3filter l
V. Comments for CVE-2026-0976
No comments yet