Vulnerability · Published Sep 28, 2026 · Assigned by redhat
CVE-2026-101333Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint
Low 3.7
In plain English
A low-severity resource allocation without limits in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | python-keycloak | no fix listed | UBUNTU-CVE-2026-101333 |
| Ubuntu:26.10 | python-keycloak | no fix listed | UBUNTU-CVE-2026-101333 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | see references |
| Red Hat | Red Hat Build of Keycloak | see references |
| Red Hat | Red Hat Single Sign-On 7 | see references |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2026-101333 vdb-entry, x_refsource_REDHAT
- RHBZ#2542498 issue-tracking, x_refsource_REDHAT