CVE-2026-2733: Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
Other sources
Improper Authorization vulnerability in the Docker v2 authentication endpoint (/protocol/docker-v2/auth) of Keycloak. The issue occurs because the server fails to validate the client’s “Enabled” status before minting an access token. Even after the client is administratively disabled, the endpoint continues to issue valid authentication tokens when provided with valid user credentials and client ID. This allows authenticated users to bypass intended administrative restrictions, potentially enabling unauthorized access to container registry resources associated with the disabled client.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2733?
The severity of CVE-2026-2733 is classified as a medium risk due to potential unauthorized access to disabled Docker registry clients.
How do I fix CVE-2026-2733?
To fix CVE-2026-2733, ensure that you upgrade to a patched version of Keycloak where the issue is resolved.
What are the potential impacts of CVE-2026-2733?
The potential impacts of CVE-2026-2733 include the risk of issuing authentication tokens to clients that have been disabled, leading to unauthorized access.
Who is affected by CVE-2026-2733?
Users of the Keycloak services that utilize the Docker v2 authentication endpoint are affected by CVE-2026-2733.
When was CVE-2026-2733 disclosed?
CVE-2026-2733 was disclosed in the second half of 2026.