CVE-2026-103884— Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Keycloak 的 X.509 客户端证书认证器中发现了一个漏洞。当启用 CRL（证书吊销列表）分发点检查时，服务器未能正确验证客户端证书中提供的文件路径。攻击者可以提供一个特制的证书，诱导服务器尝试从本地系统读取敏感文件，或通过加载超大文件来耗尽内存，从而导致信息泄露或系统崩溃。
Possible ATT&CK Techniques 2 AI
T1499.003 · Application Exhaustion Flood T1083 · File and Directory DiscoveryAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Single Sign-On 7 | any |
unknown |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103884
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2026-103884
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103884
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103884 (1)
Same Patch Batch · Red Hat · 2026-10-01 · 18 CVEs total
| CVE-2026-96658 | 9.9 CRITICAL | Foreman: safemode bypass leading to rce |
| CVE-2026-96659 | 9.1 CRITICAL | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-86345 | 9.0 CRITICAL | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to f |
| CVE-2026-12405 | 8.8 HIGH | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user |
| CVE-2026-12540 | 8.2 HIGH | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter |
| CVE-2026-12541 | 8.2 HIGH | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12544 | 7.7 HIGH | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-86344 | 7.5 HIGH | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-oper |
| CVE-2026-12423 | 7.5 HIGH | Foreman: unauthenticated information disclosure via provisioning token validation flaw |
| CVE-2026-96577 | 7.1 HIGH | Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without a |
| CVE-2026-12545 | 6.7 MEDIUM | Rubygem-hammer_cli: command injection via insecure editor invocation |
| CVE-2026-56097 | 6.5 MEDIUM | Rubygem-katello: sql injection in registry proxy via labels |
| CVE-2026-83589 | 6.1 MEDIUM | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect |
| CVE-2026-103754 | 5.9 MEDIUM | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows |
| CVE-2026-103641 | 5.5 MEDIUM | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder |
| CVE-2026-12542 | 5.3 MEDIUM | Foreman: command injection in foreman-tail |
| CVE-2026-56098 | 4.3 MEDIUM | Rubygem-katello: improper authorization logic allows resource enumeration |
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-101333
Keycloak-services: keycloak-services: unbounded metric serie -
CVE-2026-96448
Keycloak-services: keycloak-services: fgap v2 composite-blin -
CVE-2026-97846
Keycloak-services: keycloak-services: standard token exchang -
CVE-2026-97311
Keycloak-services: keycloak-services: admin rest api role-gr -
CVE-2026-97177
Keycloak-services: keycloak-services: generic user update by
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc
Same weakness: CWE-22
-
CVE-2026-104982
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf -
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauth -
CVE-2026-104478
Formwork before 2.3.13 Path Traversal via BackupController D -
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in Common -
CVE-2014-125130
CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read v
V. Comments for CVE-2026-103884
No comments yet