CVE-2026-16071

MediumCVSS 5.4/10Last modified Aug 31, 2026

Description

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-90 CWE-269

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4.14	—
Red Hat	Red Hat build of Keycloak 26.4.14	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6	—
Red Hat	Red Hat build of Keycloak 26.6.5	—
Red Hat	Red Hat build of Keycloak 26.6.5	—
Red Hat	Red Hat build of Keycloak 26.6.5	—
Red Hat	Red Hat Data Grid 8	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—
Red Hat	Red Hat Single Sign-On 7	—

References

https://access.redhat.com/errata/RHSA-2026:50846Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50847Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50848Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:50849Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-16071Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2501720Issue Tracking, Vendor Advisory

Timeline

Published: Aug 5, 2026
Last modified: Aug 31, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-160724.9A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can CVE-2026-160733.5A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text_to_image/Ne CVE-2026-160746.3A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file ast CVE-2026-160754.3A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the fil CVE-2026-160766.3A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrb CVE-2026-160775.3A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/co CVE-2026-160786.5The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and CVE-2026-160796.5The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up CVE-2026-16086.4The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up CVE-2026-160806.5The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up CVE-2026-160814.3A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.CVE-2026-160825.3A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agen