CVE-2026-107121 Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade
Attackers can intercept SMTP traffic to capture plaintext credentials and emails when STARTTLS is enabled but fails to enforce encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107121?
CVE-2026-107121 is a medium-severity vulnerability in Red Hat Build of Keycloak, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
Weakness: CWE-319
Which versions are affected by CVE-2026-107121?
How do I fix CVE-2026-107121?
No fix has been published for CVE-2026-107121 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107121 being exploited?
There is no known exploitation of CVE-2026-107121 in the wild and no public exploit code.
Sources
Also known as GHSA-4276-jw29-xwhr.