CVE-2026-4366: Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Other sources
Server-Side Request Forgery (SSRF) vulnerability in Keycloak due to improper handling of HTTP redirects during client configuration processing. The flaw arises because Keycloak follows redirect responses (e.g., HTTP 302) without validating the final destination URL. An attacker can supply a crafted sectoridentifieruri that initially matches allowed patterns but redirects to internal resources such as cloud metadata endpoints (e.g., 169.254.169.254). This causes Keycloak to issue unintended requests from its network context, enabling blind SSRF. The vulnerability can be exploited remotely without authentication or user interaction, allowing attackers to perform internal network reconnaissance and potentially access sensitive information.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable automatic following of HTTP redirects when processing client configuration requests (sector_identifier_uri). If disabling is not possible, implement validation of the final destination URL to ensure it does not point to internal or restricted addresses before performing the request.
Keycloak follow HTTP redirects for client configuration requests (sector_identifier_uri) = disabled - Compensating control
Restrict outbound network access from Keycloak servers to internal and cloud metadata endpoints (for example 169.254.169.254) using egress firewall rules, ACLs, network segmentation, or a proxy that enforces destination allowlists so Keycloak cannot reach internal resources via redirected requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4366?
CVE-2026-4366 is considered a medium severity vulnerability due to the risk of unauthorized access via server-side request forgery.
How do I fix CVE-2026-4366?
To fix CVE-2026-4366, you should apply the latest patch or update provided by Keycloak that addresses the improper HTTP redirect handling.
What are the potential impacts of CVE-2026-4366?
The potential impacts of CVE-2026-4366 include unauthorized data access and potential leakage of sensitive information.
Which versions of Keycloak are affected by CVE-2026-4366?
CVE-2026-4366 affects certain versions of Keycloak, specifically those that process client configuration requests with improper redirect handling.
Is CVE-2026-4366 exploit available in the wild?
As of now, there have been no confirmed reports of CVE-2026-4366 being exploited in the wild, but it remains a significant security concern.