CVE-2026-15573 Red Hat CVE debrief

Who should care

Administrators and users of Keycloak instances, particularly those with administrative or restricted areas, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating access controls, implementing additional monitoring, and verifying and applying vendor-provided patches or updates. Security teams and vulnerability management teams should prioritize this vulnerability based on the potential impact on Keycloak deployments in their environments.

Technical summary

The PathMatcher component in Keycloak's Authorization Services does not properly normalize URIs before comparison, allowing attackers to trick the system into applying less restrictive security policies. This can be exploited by adding extra characters like a trailing slash or matrix parameters to a URL, potentially gaining access to administrative or restricted areas. Affected Keycloak instances require updates to ensure proper normalization of URIs and prevent unauthorized access.

Defensive priority

Authenticated users with limited privileges may be able to trick the system into applying less restrictive security policies, potentially gaining access to administrative or restricted areas.

Recommended defensive actions

• Review and update access controls for Keycloak instances to ensure proper normalization of URIs.
• Implement additional monitoring to detect and respond to potential exploitation attempts.
• Verify and apply vendor-provided patches or updates to address the vulnerability.
• Confirm whether affected Keycloak deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates a flaw in Keycloak's Authorization Services, specifically in the PathMatcher component. The issue allows an authenticated user to access areas they should not have permission to see by manipulating URLs with extra characters. Further review of the official advisory and related sources is recommended to understand the full scope of affected systems and potential mitigations. Defenders should verify Keycloak instance configurations, review access controls, and monitor for potential exploitation attempts.

Official resources