CVE-2026-4366
Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
- State
- Published
- Severity
- 5.8 Medium
- Published
- Mar 18, 2026
- Updated
- Jun 9, 2026
- Reserved
- Mar 18, 2026
Description
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.8 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.12Red Hat | |
Red Hat Build of KeycloakRed Hat | |
Red Hat Build of KeycloakRed Hat | |
Red Hat JBoss Enterprise Application Platform 8Red Hat | |
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- RHSA-2026:19596vendor-advisory
- RHSA-2026:19597vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4366vdb-entry
- RHBZ#2448543issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.