Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-17615

CVE-2026-17615HIGH

Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 — Resteasy-core: resteasy sourceprovider remote unauthenticated file read

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0062   48.8     —

AFFECTED
  Product                                   Versions     Fixed
  Red Hat Build of Apache Camel 3.33.3.SP1  unspecified  6.2.16.Final-redhat-00003
  Red Hat build of Keycloak 26.6            unspecified  26.6.7-3
  Red Hat build of Keycloak 26.6            unspecified  26.6-20
  Red Hat build of Keycloak 26.6            unspecified  26.6-20
  Red Hat build of Keycloak 26.6.7          unspecified  —
  Red Hat build of Keycloak 26.6.7          unspecified  —
  Red Hat build of Keycloak 26.6.7          unspecified  —
  Red Hat build of Keycloak 26.6.7          unspecified  —
  Red Hat build of Keycloak 26.6.7          unspecified  —
  Red Hat build of Quarkus 3.27.5.SP1       unspecified  —
  + 13 more

TIMELINE
  Jul 27  Reserved by redhat
  Aug 31  Published (CNA: redhat)
  Sep 16  PATCH SHIPPED — CVE-2026-17615 (Red Hat build of Keycloak 26.6). Fixed in Red Hat build of Keycloak 26.6 26.6.7-3.

CWE-611 · CNA: redhat · CVSS v3.1 · 10 references · NVD status: Awaiting Analysis

Description

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 27, 2026	Reserved	Reserved by redhat
August 31, 2026	Published	Published (CNA: redhat)
September 16, 2026	PATCH SHIPPED	PATCH SHIPPED — CVE-2026-17615 (Red Hat build of Keycloak 26.6). Fixed in Red Hat build of Keycloak 26.6 26.6.7-3.

Affected

Affected products and packages — 23 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	Red Hat Build of Apache Camel 3.33.3.SP1	—	—	6.2.16.Final-redhat-00003
Red Hat	Red Hat build of Keycloak 26.6	—	—	26.6.7-3
Red Hat	Red Hat build of Keycloak 26.6	—	—	26.6-20
Red Hat	Red Hat build of Keycloak 26.6	—	—	26.6-20
Red Hat	Red Hat build of Keycloak 26.6.7	—	—	—
Red Hat	Red Hat build of Keycloak 26.6.7	—	—	—
Red Hat	Red Hat build of Keycloak 26.6.7	—	—	—
Red Hat	Red Hat build of Keycloak 26.6.7	—	—	—
Red Hat	Red Hat build of Keycloak 26.6.7	—	—	—
Red Hat	Red Hat build of Quarkus 3.27.5.SP1	—	—	—
Red Hat	Red Hat build of Quarkus 3.33.3.SP1	—	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—	0:3.0.26-20.el9_8
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	—	—	0:3.0.26-20.el9_4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	—	—	0:3.0.26-20.el9_6
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	—	—	—
Red Hat	Red Hat build of Apicurio Registry 3	—	—	—
Red Hat	Red Hat build of Debezium 3	—	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—	—
Red Hat	Red Hat Fuse 7	—	—	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—	—	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—	—	—
Red Hat	Red Hat Satellite 6	—	—	—

Weaknesses

CWE-611

References (10)

Authoritative record: CVE-2026-17615 at cve.org

Vendors: red hat

Weaknesses: CWE-611

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-17615 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.