# CVE-2026-18206: Keycloak keycloak-services improper wildcard domain validation in client policies

Source: https://junglewise.ai/threats/cve-2026-18206-keycloak-keycloak-services-improper-wildcard-domain-validation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-18206 · Severity: low · CVSS 3.7 · Published 2026-07-31

Keycloak, an identity and access management tool, contains a flaw in how it validates trusted domains for client registration. Administrators can set rules to only allow client updates from specific domains (like *.example.com), but the system incorrectly accepts any domain that simply ends with those letters (like 'maliciousexample.com'). This could allow an attacker who controls certain network settings to bypass these security restrictions and modify client configurations without authorization.

Technologies: [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-18206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18206 being exploited in the wild.

**How severe is CVE-2026-18206?** Low severity, with a CVSS score of 3.7, published 31 July 2026.

**Which products and versions are affected?** Red Hat build of Keycloak unspecified.

**Is there a fix for CVE-2026-18206?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18206?** Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the 'ClientUpdaterSourceHostsCondition' component of Keycloak. When a wildcard domain (e.g., *.example.com) is used to restrict client registration or updates, the system performs a simple suffix match without verifying the subdomain boundary (the preceding dot). An unauthenticated attacker who controls the reverse DNS (PTR record) of their connecting IP can craft a hostname that ends in the trusted suffix (e.g., 'attacker-example.com') to bypass these restrictions. This allows the attacker to satisfy policy conditions and potentially perform unauthorized client modifications. The attack complexity is high as it requires the attacker to control reverse DNS for their source IP.

## Affected products

- Red Hat Keycloak unspecified
- Red Hat Red Hat Build of Keycloak unspecified

## Timeline

- 2026-07-29: disclosed: Reported via Red Hat Bugzilla
- 2026-07-31: advisory: NVD published date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/security/cve/CVE-2026-18206](https://access.redhat.com/security/cve/CVE-2026-18206)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2508292](https://bugzilla.redhat.com/show_bug.cgi?id=2508292)

## Related threats

- [Keycloak SAML HTTP Parameter Pollution in HTTP-Redirect binding](https://junglewise.ai/threats/cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding)
- [Keycloak keycloak-services authorization bypass in role-users endpoint](https://junglewise.ai/threats/cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users)
- [Red Hat Keycloak authorization bypass in FGAP v2 child group endpoint](https://junglewise.ai/threats/cve-2026-14615-red-hat-keycloak-authorization-bypass-in-fgap-v2-child-group)
- [Keycloak privilege escalation in Identity Provider mapper](https://junglewise.ai/threats/cve-2026-12388-keycloak-privilege-escalation-in-identity-provider-mapper)
- [Keycloak Policy Enforcer authorization bypass via incorrect URI comparison](https://junglewise.ai/threats/cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri)