CVE-2026-0976: 
Java vulnerability analysis and mitigation

CVE-2026-0976 is an improper input validation vulnerability in Keycloak (specifically the org.keycloak/keycloak-quarkus-server component) that allows remote attackers to bypass proxy-level path filtering by crafting URLs with RFC-compliant matrix parameters. Because Keycloak's JAX-RS routing layer accepts matrix parameters (e.g., ;param) in URL path segments while common reverse proxy configurations may ignore or mishandle them, an attacker can mask path segments to reach administrative or sensitive endpoints believed to be externally inaccessible. The vulnerability was disclosed on January 15, 2026, and carries a CVSS v3.1 base score of 3.7 (Low), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-20 (Improper Input Validation): Keycloak's JAX-RS routing layer processes RFC-compliant matrix parameters (semicolon-delimited segments such as /realms;abc/master/account) in URL paths, but many reverse proxy configurations strip or ignore these parameters when evaluating path-based access control rules. This discrepancy creates a parsing inconsistency that an attacker can exploit to craft requests that appear to target a benign path at the proxy layer while actually reaching a restricted endpoint on the Keycloak backend. Exploitation is network-based, requires no authentication, and is contingent on the specific reverse proxy configuration deployed in front of Keycloak (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in limited confidentiality impact — specifically, unauthorized read access to administrative or sensitive Keycloak endpoints that are intended to be shielded by reverse proxy path filtering rules. Integrity and availability are not directly affected. The practical risk depends heavily on what sensitive endpoints are exposed and whether additional authentication controls exist on those endpoints; in some configurations, this could allow an unauthenticated attacker to probe or interact with Keycloak admin APIs (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify internet-facing Keycloak instances (specifically those running keycloak-quarkus-server) that are fronted by a reverse proxy (e.g., nginx, Apache HTTP Server, HAProxy) enforcing path-based access restrictions.
2. Identify restricted endpoints: Determine which Keycloak endpoints (e.g., admin console paths, management APIs) are expected to be blocked by the proxy's path filtering rules.
3. Craft matrix parameter payload: Construct a URL that embeds RFC-compliant matrix parameters in a path segment to obfuscate the true path, for example: GET /realms;bypass=1/master/account or GET /admin;foo/master/console.
4. Send crafted request: Submit the crafted HTTP request directly to the Keycloak instance through the reverse proxy. The proxy evaluates the path without the matrix parameter and may not match its block rule, forwarding the request to Keycloak.
5. Access restricted endpoint: Keycloak's JAX-RS layer parses the matrix parameter correctly and routes the request to the intended (restricted) endpoint, potentially exposing administrative or sensitive functionality (Red Hat Bugzilla).

• Network: HTTP requests to Keycloak containing semicolons in URL path segments (e.g., /realms;param=value/, /admin;bypass/) that would not normally appear in legitimate traffic.
• Logs: Keycloak access logs showing requests with matrix parameters (;) in path segments targeting admin or management endpoints; reverse proxy access logs showing requests forwarded to Keycloak that should have been blocked by path filtering rules.
• Logs: Discrepancies between reverse proxy access logs and Keycloak application logs for the same request paths, indicating path parsing inconsistencies.

A patch has been tracked under Red Hat Bugzilla bug 2429869, with the fix targeting org.keycloak/keycloak-quarkus-server; administrators should upgrade to the fixed version once released. As a workaround, configure the reverse proxy to normalize or strip matrix parameters from URL paths before applying path-based access control rules — for example, in nginx, use rewrite rules to remove semicolon-delimited segments. Additionally, apply defense-in-depth by enforcing authentication requirements directly on sensitive Keycloak endpoints rather than relying solely on proxy-level path filtering (Red Hat Bugzilla, Red Hat CVE).