CVE-2026-0976
Published: Jan 15, 2026
Modified: Jan 15, 2026
CVSS v3.1
3.7
Description
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
| Vendor | Product | Versions |
|---|---|---|
Red Hat | Red Hat Build of Keycloak | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 8 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 8 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform 8 | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All versions |
Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All versions |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now