Skip to content
Advisories.
Red HatCVE-2026-16071

Red Hat LDAP storage provider of Keycloak: improper privilege management

Medium5.4CVE-2026-16071 · Published Aug 5, 2026 · updated Aug 31, 2026

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Data Grid 8
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.4.14
Product
all versionsNo fix yet
all versionsNo fix yet
Red Hat build of Keycloak 26.6.5
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-90, CWE-269

More Red Hat advisories

All Red Hat
Advisory
Red Hat Enterprise Linux 10: integer overflow
Low2.2Aug 5
Red Hat RPM: buffer overflow
Medium5.5Aug 5
Red Hat OpenShift Container Platform 4: authentication bypass
Medium6.5Aug 5
Red Hat SAML broker: origin validation error
High7.4Aug 5
Red Hat Keycloak: type confusion
High8.8Aug 5
Red Hat user-event metrics recording of Keycloak.: resource exhaustion
Medium6.5Aug 5

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.