CVE-2026-4366 Details
Description
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
A blind server-side request forgery (SSRF) vulnerability has been identified in Keycloak, an identity and access management solution. The issue arises from improper handling of HTTP redirects during client configuration processing. Keycloak follows redirect responses without validating the final destination URL, allowing an attacker to supply a crafted 'sector_identifier_uri' that redirects to internal resources, such as cloud metadata endpoints. This exploitation can lead to unauthorized access to sensitive information and internal network reconnaissance.
To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as 169.254.169.254. Additionally, ensure that any configured 'sector_identifier_uri' values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redhat build of keycloak | All versions |
CPE
Remediation
| |
| redhat jboss enterprise application platform | 8.0.0 |
CPE
Remediation
| |
| redhat jboss enterprise application platform expansion pack | All versions |
CPE
Remediation
| |
| redhat single sign-on | 7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | [email protected] |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |