CVE-2026-1518: Keycloak: blind server-side request forgery (ssrf) via ciba backchannel notification endpoint in keycloak
A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.
Other sources
Blind SSRF behavior in the CIBA implementation of Keycloak. The issue arises because the backchannelclientnotificationendpoint configured during Dynamic Client Registration or client administration is not sufficiently validated before use. An attacker with high privileges (Administrator access or a valid Initial Access Token) can configure this endpoint to point to arbitrary internal URLs, including localhost or cloud metadata services. When a CIBA authentication request is initiated in ping mode, Keycloak sends a blind POST request to the configured endpoint. While the attacker cannot observe the response, the behavior allows limited influence over server-side network interactions and may enable abuse of internal services.
— Red Hat
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies, including the Secure Client URIs Pattern executor. Therefore, this CVE has been rejected.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure Keycloak Client Policies to use the “Secure Client URIs Pattern” executor so that only permitted (allowlisted) backchannel_client_notification_endpoint URIs are accepted for CIBA ping-mode backchannel POST requests.
Keycloak CIBA Client Policies (Secure Client URIs Pattern executor) Secure Client URIs Pattern executor = Enable/Configure to enforce an allowlist pattern for client-configured backchannel notification endpoints - Compensating control
Restrict who can configure CIBA backchannel notification endpoints (client registration/client administration) to trusted administrators, since the documented mitigations rely on administrator-controlled configuration via Client Policies.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1518?
The severity of CVE-2026-1518 is classified as high due to its potential to allow unauthorized access to internal services.
How do I fix CVE-2026-1518?
To fix CVE-2026-1518, ensure that backchannel notification endpoints are properly validated and restrict them to trusted sources.
Which versions of Keycloak are affected by CVE-2026-1518?
CVE-2026-1518 affects Red Hat Keycloak up to version 26.5.2, as well as the related maven package org.keycloak:keycloak-parent.
What kind of attack does CVE-2026-1518 enable?
CVE-2026-1518 enables blind server-side request forgery (SSRF) attacks, which can manipulate internal service requests.
Is there a workaround for CVE-2026-1518 before applying a patch?
Yes, a temporary workaround for CVE-2026-1518 is to disable the CIBA feature until a patch is applied.