CVE-2026-0976

Published: Jan 15, 2026Modified: Aug 9, 2026Deferred

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://access.redhat.com/security/cve/CVE-2026-0976

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2429869

Source: secalert@redhat.com

Timeline

No history available yet.