Executive brief
Keycloak, a widely used identity and access management system, contains a vulnerability that allows attackers to trick the server into making unauthorized requests to internal network resources. By exploiting this flaw, an attacker could gain access to sensitive internal data, such as cloud infrastructure metadata or private service configurations, which are normally protected from the public internet. This could lead to the exposure of internal network maps and other confidential information.
Technical details
A blind Server-Side Request Forgery (SSRF) vulnerability exists in Keycloak's keycloak-services component due to improper validation of HTTP redirects. When processing client configuration requests, specifically those involving the 'sector_identifier_uri', the application follows HTTP 302 redirects without validating the final destination. An unauthenticated remote attacker can provide a URI that redirects to internal-only resources, such as the cloud metadata service (169.254.169.254). This allows the attacker to perform internal network reconnaissance and potentially disclose sensitive information from the server's local network context. The issue is addressed in Red Hat build of Keycloak 26.4.12.
Affected products
- Red Hat Keycloak All versions prior to 26.4.12
- Red Hat build of Keycloak versions prior to 26.4.12
- Red Hat JBoss Enterprise Application Platform 8.0.0
Timeline
- 2026-03-18: disclosed: Initial vulnerability report and CVE assignment
- 2026-05-20: patched: Red Hat released security updates for Keycloak 26.4.12