CVE-2026-107121

Executive Summary

CVE-2026-107121 is a cleartext transmission vulnerability (CWE-319) in the SMTP email configuration handling of the Keycloak keycloak-services component. When the STARTTLS option is enabled, Keycloak does not strictly enforce an encrypted connection and can silently fall back to unencrypted SMTP communication if the STARTTLS negotiation is tampered with by a network-positioned attacker. This allows an adversary who can intercept traffic to capture sensitive email credentials and message content in plaintext, with a CVSS base score of 6.5.

Technical Analysis

The vulnerability resides in the SMTP email configuration handling logic within the keycloak-services component. STARTTLS is an opportunistic upgrade mechanism in the SMTP protocol: a client connects over cleartext, issues the STARTTLS command, and — if the server responds affirmatively — upgrades the session to TLS. The security weakness arises because STARTTLS provides no cryptographic guarantee that the upgrade will occur or succeed. An active man-in-the-middle (MITM) can strip or alter the STARTTLS capability response, causing the client to either skip the upgrade entirely or terminate the TLS handshake and continue in cleartext.

The NVD description states that when STARTTLS is enabled, Keycloak "fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with." This is a classic STARTTLS downgrade / negotiation-stripping flaw. A robust implementation should enforce certificate validation and abort the connection when STARTTLS is stripped or fails; Keycloak's keycloak-services SMTP handling instead permits a silent fallback to plaintext.

The attack surface is the SMTP egress path between the Keycloak server and its configured mail relay. Any host on that network path — a rogue switch/router, an ARP/DNS-spoofing attacker on the same segment, or a compromised intermediate hop — can manipulate the SMTP dialogue. Because the flaw is negotiated at the application/protocol layer, no credentials are required (PR:N) and no user interaction is required (UI:N), though exploitation requires the attacker to already occupy a privileged network position (reflected in AC:H).

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N yields a base score of 6.5. The high Confidentiality impact (C:H) reflects the direct exposure of SMTP credentials and message bodies. The low Integrity impact (I:L) reflects the attacker's ability to alter the mail transaction (injecting, modifying, or dropping messages) once the session is in cleartext. Availability is unaffected (A:N).

No public PoC, exploit code, or Nuclei template is available. No affected version range has been confirmed by tracked sources. This is a protocol-negotiation weakness rather than a memory-safety or injection flaw, and exploitation does not require crafting a specific payload — the attacker merely manipulates or strips the STARTTLS capability in transit.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-319, STARTTLS downgrade) and the NVD description. No specific function names, endpoints, or parameters are fabricated.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment that sends email via an SMTP relay and determines that the SMTP configuration uses the STARTTLS option (the vulnerable setting). Positional reconnaissance establishes that the attacker controls or can influence a network hop on the path between the Keycloak server and the mail relay (same L2 segment, compromised route, or DNS/MX redirection).

2. Triggering the flaw class. When Keycloak initiates an SMTP session and issues STARTTLS, the attacker (positioned in the middle) tampers with the negotiation — for example, by suppressing, stripping, or manipulating the STARTTLS capability/response so the upgrade is not honored. Because the affected keycloak-services SMTP handling does not strictly enforce encryption, the client continues the session without TLS instead of aborting.

3. Payload / execution method. No exploit payload is required. The attacker's "payload" at the protocol level is the manipulation of the SMTP negotiation, downgrading the connection to cleartext. The attacker then passively captures the subsequent SMTP transaction — including authentication credentials transmitted in the clear and the message content.

4. Post-exploitation impact. With the session in cleartext, the attacker harvests SMTP/email credentials (which may grant access to the mail relay or downstream mail services) and reads the content of emails Keycloak emits (e.g., password-reset links, verification codes, invitation messages, and other identity-related notifications). These captured artifacts can enable account takeover via password-reset flows, follow-on attacks against the mail infrastructure using the harvested credentials, and further intelligence gathering against the identity provider's user base.

The high value of identity-provider emails (password reset and verification tokens) makes this downgrade a meaningful stepping stone toward account compromise, even though the vulnerability itself does not directly grant access to Keycloak's authentication logic.

Impact Assessment

• Business impact: Exposure of SMTP credentials and the content of identity-related email (password resets, verification links, invitations). Compromise of mail credentials can lead to mail-server abuse, lateral movement, and brand/abuse impact. Password-reset email interception can facilitate targeted account takeover.
• Affected systems: Any Keycloak deployment where (a) the keycloak-services component handles SMTP email and (b) the SMTP configuration uses the STARTTLS option over a network path an attacker can intercept.
• Blast radius: Determined by the scope of the SMTP credentials and the sensitivity of mail sent by Keycloak. Scope is unchanged (S:U) — the flaw does not inherently cross security boundaries beyond the affected component and its mail transaction.
• CVSS subscores: Confidentiality High (C:H) — direct exposure of credentials and message content; Integrity Low (I:L) — possible modification/injection of mail in cleartext; Availability None (A:N). Attack Vector Network (AV:N), Attack Complexity High (AC:H) — requires a MITM network position; Privileges Required None (PR:N); User Interaction None (UI:N).
• Exploit maturity: No public exploit, PoC, or Nuclei template. CISA KEV: NO. EPSS: not scored by FIRST.org at time of writing.

Detection Guidance

Sigma Rule

title: Suspicious SMTP STARTTLS Downgrade / Cleartext Fallback (Keycloak SMTP)
id: 3f8a1c2e-9b4d-4e7a-b2c1-7d6e5f0a1b23
status: experimental
description: Detects SMTP sessions from a Keycloak host that proceed in cleartext despite STARTTLS being expected, indicating possible STARTTLS stripping/downgrade.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107121
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: zeek
detection:
  selection_port:
    dst_port: 25
  selection_starttls:
    service: "smtp"
    starttls: false
  condition: selection_port and selection_starttls
falsepositives:
  - Mail relays legitimately configured without STARTTLS
  - Internal test relays
level: medium
tags:
  - attack.t1040
  - cve.2026.107121

YARA Rule

rule CVE_2026_107121_SMTP_STARTTLS_Downgrade_Artifacts
{
    meta:
        description = "Detects captured/plaintext SMTP transaction artifacts consistent with STARTTLS downgrade abuse affecting Keycloak SMTP email handling"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107121"
        date = "2026-01-01"
        severity = "medium"
        tlp = "WHITE"

    strings:
        $smtp_ehlo = "EHLO " ascii nocase
        $starttls  = "STARTTLS" ascii nocase
        $auth_login = "AUTH LOGIN" ascii nocase
        $auth_plain = "AUTH PLAIN" ascii nocase
        $auth_user  = "AUTH LOGIN" ascii nocase

    condition:
        uint16(0) == 0x534d or
        (2 of ($smtp_ehlo, $starttls, $auth_login, $auth_plain, $auth_user))
}

Suricata IDS Rule

alert tcp any any -> any 25 ( \
  msg:"CVE-2026-107121 Possible Keycloak SMTP STARTTLS Downgrade / Cleartext Auth"; \
  flow:established,to_server; \
  content:"AUTH "; nocase; depth:6; \
  content:"LOGIN"; nocase; distance:1; \
  threshold:type limit, track by_src, count 1, seconds 60; \
  reference:cve,2026-107121; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107121; \
  classtype:policy-violation; \
  sid:2026107121; rev:1; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; )

Elastic Detection

network where destination.port == 25 and
  network.transport == "tcp" and
  not tls and
  process.name in ("java", "java.exe")

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=zeek_conn
| search dest_port=25
| eval cleartext=if(isnull(tls_established) OR tls_established="false", 1, 0)
| where cleartext=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="smtp,keycloak,cve-2026-107121,">
  <rule id="107121" level="8">
    <decoded_as>json</decoded_as>
    <field name="dst_port">25</field>
    <field name="starttls">false</field>
    <description>CVE-2026-107121: Possible Keycloak SMTP STARTTLS downgrade - cleartext SMTP session observed (email credentials may be exposed).</description>
    <mitre>
      <id>T1040</id>
    </mitre>
    <group>policy_violation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or version range is currently confirmed.

1. Immediate mitigations (do not rely on STARTTLS alone):

   • Enforce SMTP over implicit TLS (SMTPS, typically port 465) instead of opportunistic STARTTLS where the relay supports it, so cleartext fallback is not possible.
   • Enforce strict STARTTLS policy on the SMTP relay and the mail path: require TLS and reject cleartext submission; disable plaintext AUTH on the relay so credentials cannot be submitted over an unencrypted channel.
   • Validate the mail relay certificate and use MTA-STS / DANE where the relay and DNS infrastructure support it, to prevent downgrade and redirection.
   • Segment the SMTP egress path so the Keycloak server and its mail relay communicate only over trusted, controlled infrastructure; prevent untrusted hosts from occupying that L2/L3 path (e.g., active DHCP snooping, static ARP for the relay, and a dedicated VLAN).
   • Rotate any SMTP credentials that may have transited a monitored or untrusted path.

2. Patch / upgrade steps:

   • No patch is currently available per tracked sources. Monitor the Keycloak project's security advisories, release notes, and CVE feeds for a fix that strictly enforces encryption when STARTTLS is enabled.
   • When a fixed version is published, upgrade the keycloak-services component / Keycloak distribution and re-test the SMTP configuration to confirm that STARTTLS negotiation failures abort the connection rather than fall back to cleartext.

3. Long-term hardening:

   • Prefer implicit-TLS SMTP or authenticated, TLS-only submission for all notification email.
   • Minimize the sensitivity of information sent via email (e.g., avoid transmitting credentials or reusable tokens in mail where an alternative exists).
   • Continuously monitor SMTP egress with the detection rules above and alert on any cleartext SMTP authentication or STARTTLS-stripped sessions originating from identity infrastructure.
   • Apply network-layer protections against MITM (encrypted tunnels for SMTP transport, network access control) as defense-in-depth.

References

• NVD — CVE-2026-107121: https://nvd.nist.gov/vuln/detail/CVE-2026-107121
• MITRE CWE-319 (Cleartext Transmission of Sensitive Information): https://cwe.mitre.org/data/definitions/319.html
• MITRE ATT&CK T1040 (Network Sniffing): https://attack.mitre.org/techniques/T1040/
• Keycloak project security advisories / release notes: https://www.keycloak.org/ (consult for an eventual fix)
• RFC 3207 (SMTP Service Extension for Secure SMTP over TLS — STARTTLS opportunistic nature): https://www.rfc-editor.org/rfc/rfc3207

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-107121. CISA KEV: NO. EPSS: not yet scored by FIRST.org at time of writing; no public PoC, exploit code, or Nuclei template is available.