CVE-2026-0976

{
  "id": "CVE-2026-0976",
  "sourceIdentifier": "[email protected]",
  "published": "2026-01-15T13:16:04.910",
  "lastModified": "2026-10-22T22:17:41.857",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable."
    },
    {
      "lang": "es",
      "value": "Se encontró un defecto en Keycloak. Esta vulnerabilidad de validación de entrada incorrecta ocurre porque Keycloak acepta parámetros de matriz conformes con RFC en segmentos de ruta de URL, mientras que las configuraciones comunes de proxy inverso pueden ignorarlos o manejarlos incorrectamente. Un atacante remoto puede elaborar solicitudes para enmascarar segmentos de ruta, eludiendo potencialmente el filtrado de rutas a nivel de proxy. Esto podría exponer puntos finales administrativos o sensibles que los operadores creen que no son accesibles externamente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Keycloak 26.4.9",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "keycloak-quarkus-server",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server-app",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server-deployment",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server-app",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "keycloak-quarkus-server-deployment",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-01-15T14:44:09.361820Z",
          "id": "CVE-2026-0976",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:2365",
      "source": "[email protected]"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-0976",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429869",
      "source": "[email protected]"
    }
  ]
}