EUVD-2026-53384
GHSA-xj3w-m54w-h7p9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable via standard API calls (AV:N), no special conditions once metrics are enabled (AC:L), low-privileged authenticated account required (PR:L), purely an availability impact with no data exposure.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
AnalysisAI
Prometheus metric label cardinality exhaustion in Red Hat Build of Keycloak allows any authenticated user to crash the service by flooding its metric store with unique entries. When the Keycloak metrics subsystem is active, failed account operations (such as login attempts referencing nonexistent client IDs) cause raw, unsanitized error strings to be registered as Prometheus label values; because Prometheus stores each unique label combination as a distinct time series, a low-privileged attacker can generate an unbounded number of distinct metric entries, consuming JVM heap until the process crashes or becomes unresponsive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete conditions must both be satisfied for exploitation: first, the Prometheus metrics endpoint must be explicitly enabled in the Keycloak configuration (this is not universally active by default and requires deliberate operator configuration of the metrics subsystem); second, the attacker must hold a valid low-privileged authenticated session in the Keycloak realm (PR:L per CVSS vector - any standard user account suffices, no admin role is required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) correctly characterizes a network-reachable, low-complexity denial-of-service requiring only a low-privileged (authenticated) account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged user - such as a legitimate end-user account or a compromised service account - writes a script that submits repeated failed authentication or account-operation requests to the Keycloak API, each referencing a different randomly generated client_id string. Each unique client_id causes Keycloak to register a new Prometheus metric label combination in the JVM heap. … |
| Remediation | The primary remediation is to apply the vendor-issued patch once Red Hat publishes an updated package for the affected products; monitor https://access.redhat.com/security/cve/CVE-2026-16100 and the associated Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2501730) for patch availability and exact fixed versions, which were not confirmed in the data available at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today