A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. 

In Keycloak 24.0.8, a vulnerability allows unauthorized file access through path traversal in file vault configurations due to permissive regex validation. This weakness allows reading any file to the Keycloak server, but the admin user will not be able to access the contents unless they have also compromised the remote system that the password/secret is intended to be sent to. In practical terms, the only information leaked to the admin user is the existence of the file.

Version affected: <= 26.0.2