Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Keycloak accepts unsafe metric input, may allow attacks
published 16 days ago
Summary
Keycloak can be given metric names or tags that haven’t been cleaned, which could let an attacker influence how the system records data. This could lead to errors, data corruption, or possible code execution. Update Keycloak to the latest version or apply the vendor’s patch that sanitizes all metric inputs.
What to do
- Update cleanstart keycloak to version 26.4.2-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | keycloak |
< 26.4.2-r1 Fix: upgrade to 26.4.2-r1
|
Original advisory text
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform
Security vulnerability affects the keycloak package. Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLEANSTART-2026-DL27432 · OSV
Track software like this
Free during beta