CVE-2026-16100: Red Hat Build Of Keycloak

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

Affected products

• Red Hat Build Of Keycloak: from 26.6, before 26.6.5 (fixed in 26.6.5)

Published 2026-08-05. Last modified 2026-08-31.