Bug 2501720 (CVE-2026-16071)

Summary: CVE-2026-16071 keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, security-response-team, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-15   

Description OSIDB Bzimport 2026-07-17 13:18:39 UTC
A vulnerability was found in Keycloak where the LDAP storage provider fails to validate the search base during specific entry-DN queries. A delegated administrator with user-query permissions can invoke the admin users endpoint with a crafted query parameter (q=LDAP_ENTRY_DN:target-dn). The LDAP provider replaces the configured users DN with the caller-supplied DN and performs an object-scope lookup. If the target object matches the user schema, Keycloak returns the UserRepresentation and may import the user into local storage. This allows an attacker to bypass organizational unit boundaries within the same LDAP directory to disclose user attributes and metadata for accounts they should not be able to access.