Security1 hOctober 30, 2026, 09:30

Keycloak CVE-2026-9083: path traversal in java-keystore provider

CVE-2026-9083 (CVSS 4.9) in Keycloak lets a realm administrator with the manage-realm role supply arbitrary keystore file paths and use differential error messages to probe the host filesystem. It is fixed in Keycloak 26.6.4 and 26.4.13, and in Red Hat builds 26.6.4-2 and 26.4.13-1.

DEV Community

Open source

Keycloak CVE-2026-9083: path traversal in java-keystore provider

CVSS 4.9, CWE-22 path traversal in JavaKeystoreKeyProviderFactory
Requires manage-realm role; leaks via distinct error messages
Fixed in Keycloak 26.6.4 and 26.4.13
Not listed in CISA KEV catalog

#Keycloak#RedHat

Ollama path traversal CVE-2026-103663 can lead to root code execution

Security

CVE-2026-78249: Path Traversal in Fujifilm and Sharp MFP Web Consoles

Security

Keycloak stored XSS via case-sensitive URI scheme validation bypass

Security

Keycloak CVE-2026-9083: path traversal in java-keystore provider

Ollama path traversal CVE-2026-103663 can lead to root code execution

CVE-2026-78249: Path Traversal in Fujifilm and Sharp MFP Web Consoles

Keycloak stored XSS via case-sensitive URI scheme validation bypass

NLTK WekaClassifier flaw allows path traversal and sandbox bypass