CVE-2026-19729 Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
A realm administrator can probe arbitrary filesystem paths via keystore parameters to determine file existence and readability, exposing sensitive system information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19729?
CVE-2026-19729 is a medium-severity path traversal vulnerability in Red Hat Single Sign-On 7, published on 9 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.
Weakness: CWE-22
Which versions are affected by CVE-2026-19729?
How do I fix CVE-2026-19729?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-19729 being exploited?
There is no known exploitation of CVE-2026-19729 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-QD34582, GHSA-g77f-483m-m79j.