CVE-2026-16100
published 2026-08-05CVE-2026-16100: A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.55%
45.3th percentile
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk-keycloak-rhel9 | rhbk-keycloak-rhel9 | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-operator-bundle_26.6.5-1 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-11 | — | — |
| rhbk | keycloak-rhel9_26.6-11 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the user-event metrics recording of Keycloak.
ghsa_unreviewed·2026-08-05
CVE-2026-16100 [MEDIUM] CWE-770 A flaw was found in the user-event metrics recording of Keycloak.
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Red Hat
keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text
vendor_redhat·2026-08-05·CVSS 6.5
CVE-2026-16100 [MEDIUM] keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text
keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires an authenticated user with specific account management permissions. Successful exploitat
No detection rules found.
No public exploits indexed.
2026-08-05
Published