PT-2026-26028 · Keycloak · Keycloak

Osidb Bzimport · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-4366

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak, an identity and access management solution, where it incorrectly handles HTTP redirects when processing specific client configuration requests. This allows an attacker to manipulate the server into making unintended requests to internal or restricted resources. Consequently, sensitive internal services, such as cloud metadata endpoints, could be accessed, potentially leading to information disclosure and enabling attackers to map internal network infrastructure. The issue involves a server-side request forgery (SSRF) condition through improper handling of HTTP redirects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4366

Affected Products

Keycloak

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4366 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-4366 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2448543 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034255357552300320 · Twitter Post
• https://twitter.com/cyberbivash/status/2034167432755974542 · Twitter Post
• https://twitter.com/CVEarity/status/2034152712766685414 · Twitter Post