CVE-2026-103884 in Keycloak
Summary
by MITRE • 10/01/2026
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within Keycloak's X.509 client certificate authenticator represents a critical security flaw rooted in improper input validation of file paths contained within Certificate Revocation List (CRL) Distribution Points. When the server is configured to validate CRLs, it parses the Uniform Resource Identifiers or direct file paths embedded in the client certificates presented during authentication. The core technical deficiency lies in the failure to sanitize these path strings before processing them. This lack of rigorous validation allows an attacker to manipulate the certificate structure to include absolute local filesystem paths rather than standard network URLs for CRL retrieval. By exploiting this misconfiguration, a malicious actor can force the Keycloak server to attempt reading arbitrary files from the underlying operating system where the service is hosted.
This flaw directly facilitates two distinct categories of attacks: information disclosure and denial of service through resource exhaustion. In the context of information disclosure, an attacker who possesses or crafts a valid X.509 client certificate containing a crafted CRL distribution point pointing to sensitive local files can trigger the server to read those contents. If the Keycloak process has sufficient permissions, it may expose configuration secrets, private keys, database credentials, or other confidential data stored on the disk. This effectively bypasses access controls by leveraging the application's own trust mechanism against itself, turning a security feature intended for validation into an attack vector for local file inclusion attacks similar to those seen in web applications but operating at the infrastructure authentication layer.
The second impact involves resource exhaustion leading to system instability or crash. An attacker can craft certificates with CRL distribution points that reference extremely large files located on the local filesystem. When Keycloak attempts to load and parse these oversized files during the certificate validation process, it consumes significant amounts of memory and CPU resources. This behavior mirrors a classic denial-of-service attack pattern where the system's finite resources are depleted by maliciously constructed inputs. The resulting impact is not merely performance degradation but potentially a complete service outage as the server becomes unresponsive or crashes due to out-of-memory conditions, disrupting authentication services for all legitimate users relying on Keycloak.
From an industry standards perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-400 Uncontrolled Resource Consumption. The failure to restrict file access operations to expected directories constitutes a path traversal issue, while the ability to trigger excessive memory usage falls under uncontrolled resource consumption. In terms of MITRE ATT&CK mapping, this behavior is consistent with techniques involving Local File Access for data exfiltration and potentially Denial of Service via application layer attacks. The exploitation requires an attacker to present a malicious certificate during mutual TLS or X.509 authentication flows, making it particularly dangerous in environments where client certificates are used for high-assurance identity verification.
Mitigation strategies must focus on both immediate configuration changes and long-term architectural improvements. Administrators should immediately disable CRL distribution point checking if the feature is not strictly required by their security policy, as this removes the attack surface entirely. If CRL validation is necessary, it is imperative to ensure that Keycloak is updated to a version where this path traversal flaw has been patched with proper input sanitization and length limits on file reads. Furthermore, running Keycloak under restricted system privileges can limit the impact of any successful local file read attempts by ensuring the process does not have access to sensitive configuration files or private keys stored outside its designated working directory. Regular auditing of certificate validation logic and implementing strict allow-lists for expected CRL sources rather than trusting arbitrary paths provided in certificates are also recommended defensive measures.