EUVD-2026-53383
GHSA-m28w-c4hx-9fvg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network vector confirmed by web-based admin interface; PR:L reflects delegated admin role requirement; C:L and I:L for directory disclosure and unintended user import; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
AnalysisAI
Keycloak's LDAP storage provider allows delegated administrators to bypass configured search boundaries by supplying a crafted Distinguished Name (DN), exposing account information from unauthorized directory subtrees and triggering unintended user imports into Keycloak local storage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained to authenticated delegated administrators with access to the LDAP federation interface.
Technical ContextAI
Keycloak's LDAP user federation provider maps external directory entries to internal Keycloak identities using a configured search base DN, which is intended to act as an authorization boundary - restricting which directory subtrees can be federated. The flaw is a missing validation check when a delegated administrator performs a user lookup by supplying a specific LDAP entry DN: the system processes the lookup without verifying that the target DN falls within the configured search boundary. This is functionally analogous to a path traversal or authorization bypass at the LDAP query layer (behavior consistent with CWE-284 Improper Access Control, though no CWE is formally assigned). Affected products per CPE data include: cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack. The vulnerability exists in the LDAP provider component shared across these Red Hat products.
RemediationAI
Apply the vendor patch once Red Hat publishes an updated package via the advisory at https://access.redhat.com/security/cve/CVE-2026-16071; a specific patched release version is not confirmed in the available data, so monitor the Red Hat Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2501720) for a confirmed fix version. As an immediate compensating control, audit and minimize the set of accounts holding delegated administrator roles in Keycloak - reducing the delegated admin population directly limits the attacker surface, as PR:L privileges are required. Additionally, review LDAP federation provider configurations to confirm search base DNs are as restrictive as possible, and enable audit logging on Keycloak's admin events to detect anomalous user federation or import activity from unexpected DN paths. Restricting network access to the Keycloak admin console to trusted internal segments reduces exposure, with the trade-off of impacting remote administration workflows.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today