CVE-2026-16071

Modified Modified - Updated After Analysis

LDAP Search Boundary Bypass in Keycloak

Publication date: 2026-08-05

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-31

Generated

2026-09-15

AI Q&A

2026-08-05

EPSS Evaluated

2026-09-13

NVD

CVE-2026-16071

EUVD

EUVD-2026-53383

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	build_of_keycloak	From 26.4 (inc) to 26.4.14 (exc)
redhat	build_of_keycloak	From 26.6 (inc) to 26.6.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is in Keycloak's LDAP storage provider, which manages user identities from external directories. A delegated administrator can exploit missing validation in search queries to look up users outside the intended search boundary. This allows disclosure of user account details from unauthorized parts of the LDAP directory and may import those users into the local Keycloak database.

Detection Guidance

To detect this vulnerability, monitor Keycloak admin endpoints for unusual queries using the LDAP_ENTRY_DN parameter. Check logs for requests to /admin/realms/{realm}/users with q=LDAP_ENTRY_DN:target-dn. Unauthorized LDAP DN lookups outside configured boundaries may indicate exploitation attempts.

Impact Analysis

An attacker with delegated admin privileges could access user account information from unauthorized LDAP Organizational Units (OUs). This may lead to unauthorized disclosure of sensitive user attributes and metadata. Additionally, the attacker could import unauthorized users into the local Keycloak database, potentially affecting access control and user management.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Exposure of user attributes from unauthorized OUs may result in non-compliance with data access and protection requirements, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Apply the latest Keycloak patches immediately. Restrict delegated administrator privileges to only necessary users. Review LDAP provider configurations to ensure proper search boundary validation. Monitor for unauthorized user imports and LDAP queries outside configured OUs.

Hi! I’m here to help you understand CVE-2026-16071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70