CVE-2026-4366

Summary

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat build of Keycloak 26.426.4.12-1 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-17 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-17 < *unaffected

Weaknesses

  • CWE-918: Server-Side Request Forgery (SSRF)

Workarounds

To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as 169.254.169.254. For example, on Red Hat Enterprise Linux, you can use firewalld to add a rich rule: sudo firewall-cmd --permanent --zone=public --add-rich-rule=&#39;rule family=&#34;ipv4&#34; destination address=&#34;169.254.169.254&#34; reject&#39; sudo firewall-cmd --reload This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured sector_identifier_uri values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References