A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Vulnerable Products
red hat:red hat build of keycloak 26.6.5
red hat:red hat single sign-on 7
red hat:red hat build of keycloak 26.6
red hat:red hat jboss enterprise application platform expansion pack
red hat:red hat data grid 8
red hat:red hat build of keycloak 26.4.14
red hat:red hat build of keycloak 26.4
References 6
https://access.redhat.com/security/cve/CVE-2026-16071
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2501720
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50846
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50847
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50848
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50849
secalert@redhat.com