PT-2026-26028 · Keycloak · Keycloak

Osidb Bzimport · CVE-2026-4366 · Publicado 2026-03-18 · Atualizado 2026-06-09

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak, an identity and access management solution, where it incorrectly handles HTTP redirects when processing specific client configuration requests. This allows an attacker to manipulate the server into making unintended requests to internal or restricted resources. Consequently, sensitive internal services, such as cloud metadata endpoints, could be accessed, potentially leading to information disclosure and enabling attackers to map internal network infrastructure. The issue involves a server-side request forgery (SSRF) condition through improper handling of HTTP redirects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-4366

Produtos afetados

Keycloak

Referências · 9

• https://bugzilla.redhat.com/show_bug.cgi?id=2448543 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:19597 · Aviso do Fabricante
• https://t.me/cveNotify/166699 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2034255357552300320 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4366 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2026-4366 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2034152712766685414 · Publicação no Twitter
• https://access.redhat.com/errata/RHSA-2026:19596 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034167432755974542 · Publicação no Twitter