All vulnerabilities
CVE-2026-0976GHSA-v897-pv23-r8cw

org.keycloak:keycloak-quarkus-server: Keycloak has an improper input validation vulnerability

Red Hat org.keycloak:keycloak-quarkus-servermavenFrameworks
Open in ThreatlineRecord JSON
CVSS
3.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published15 Jan 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

Text from CVE List

Affected versions 52

  • org.keycloak:keycloak-quarkus-server, maven<= 26.2.5GitHub
  • org.keycloak:keycloak-quarkus-server, Mavenfrom first release, through 26.2.5OSV
  • org.keycloak:keycloak-quarkus-server, Maven12.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven12.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven12.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven12.0.3OSV
  • org.keycloak:keycloak-quarkus-server, Maven12.0.4OSV
  • org.keycloak:keycloak-quarkus-server, Maven13.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven13.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven14.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven15.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven15.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven15.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven15.1.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven15.1.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven16.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven16.1.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven16.1.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven17.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven17.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven18.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven18.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven18.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven19.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven19.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven19.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven19.0.3OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.3OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.4OSV
  • org.keycloak:keycloak-quarkus-server, Maven20.0.5OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.1.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.1.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven21.1.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.3OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.4OSV
  • org.keycloak:keycloak-quarkus-server, Maven22.0.5OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.0OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.1OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.2OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.3OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.4OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.5OSV
  • org.keycloak:keycloak-quarkus-server, Maven23.0.6OSV

References 5