CVE-2026-4366: Keycloak SSRF via improper HTTP redirect handling in keycloak-services

CVE-2026-4366 · Severity: medium · CVSS 5.8 · Published 2026-03-18

Keycloak, a widely used identity and access management system, contains a vulnerability that allows attackers to trick the server into making unauthorized requests to internal network resources. By exploiting this flaw, an attacker could gain access to sensitive internal data, such as cloud infrastructure metadata or private service configurations, which are normally protected from the public internet. This could lead to the exposure of internal network maps and other confidential information.

Technologies: Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Single Sign-On. Vendors: Redhat.

Quick answers

Is CVE-2026-4366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4366 being exploited in the wild.
How severe is CVE-2026-4366?
Medium severity, with a CVSS score of 5.8, published 18 March 2026.
Which products and versions are affected?
Red Hat Keycloak All versions prior to 26.4.12; Red Hat build of Keycloak versions prior to 26.4.12; Red Hat JBoss Enterprise Application Platform 8.0.0.
Is there a fix for CVE-2026-4366?
A patch was published on 2026-05-20: Red Hat released security updates for Keycloak 26.4.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4366 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4366?
Check whether you run Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack or Redhat Single Sign-On. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A blind Server-Side Request Forgery (SSRF) vulnerability exists in Keycloak's keycloak-services component due to improper validation of HTTP redirects. When processing client configuration requests, specifically those involving the 'sector_identifier_uri', the application follows HTTP 302 redirects without validating the final destination. An unauthenticated remote attacker can provide a URI that redirects to internal-only resources, such as the cloud metadata service (169.254.169.254). This allows the attacker to perform internal network reconnaissance and potentially disclose sensitive information from the server's local network context. The issue is addressed in Red Hat build of Keycloak 26.4.12.

Affected products

  • Red Hat Keycloak All versions prior to 26.4.12
  • Red Hat build of Keycloak versions prior to 26.4.12
  • Red Hat JBoss Enterprise Application Platform 8.0.0

Timeline

  • 2026-03-18: disclosed: Initial vulnerability report and CVE assignment
  • 2026-05-20: patched: Red Hat released security updates for Keycloak 26.4.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.