Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labels

Impact

When user-event metrics are enabled, Keycloak records raw error text from failed account operations as Prometheus label values, and that text embeds user-supplied input such as a nonexistent client ID. Any user who can authenticate can loop over unique client IDs and mint an unbounded number of distinct metric series until the JVM heap is exhausted and the server crashes or stops answering. On a GPU fleet this is an availability hit on the identity layer rather than on the GPUs: jobs already running keep running, but if Keycloak fronts the scheduler UI, the Kubernetes API OIDC path, the registry or the observability stack, tenants cannot get new tokens and operators cannot log in to respond. Recovery is a restart, so the blast radius is bounded, but a scripted attacker can re-trigger it as fast as the service comes back.

Who can reach it

Any account that can authenticate to the realm and reach the account/client endpoints - network-reachable, low privileges, no admin rights, no user interaction. Not exploitable unauthenticated, and not exploitable at all if user-event metrics are disabled.

What to do

Red Hat shipped errata RHSA-2026:50848 and RHSA-2026:50849 for the Red Hat build of Keycloak; apply the updated build and restart the Keycloak server or roll the Keycloak pods. No node drain or reboot is involved - this is a daemon restart of the IdP, which does log out in-flight authentication attempts, so schedule it alongside other control-plane work. If the update cannot be applied immediately, disabling user-event metrics removes the code path that writes the attacker-controlled labels. The record does not name a fixed upstream version beyond the affected 26.6.x line.

References

Related entries

• open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
• Grafana: injected timeGroup macro in a SQL query exhausts memory and kills the server processCVE-2026-19475 · Grafana SQL data sources (regex macro parsing, timeGroup injected via WHERE clause)Medium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium
• Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
• Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium
• GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium