{
  "threat_severity" : "Moderate",
  "public_date" : "2026-03-18T00:00:00Z",
  "bugzilla" : {
    "description" : "keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak",
    "id" : "2448543",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2448543"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-918",
  "details" : [ "A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.", "A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure." ],
  "statement" : "MODERATE impact: Keycloak is vulnerable to a blind Server-Side Request Forgery (SSRF) due to improper handling of HTTP redirects during client configuration. An attacker can exploit this remotely without authentication or user interaction by crafting a `sector_identifier_uri` that redirects to internal resources, potentially leading to information disclosure and internal network reconnaissance.",
  "acknowledgement" : "Red Hat would like to thank Georgije Vukov (Elite Security Systems) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-05-20T00:00:00Z",
    "advisory" : "RHSA-2026:19597",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-operator-bundle:26.4.12-1"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-05-20T00:00:00Z",
    "advisory" : "RHSA-2026:19597",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9:26.4-17"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4",
    "release_date" : "2026-05-20T00:00:00Z",
    "advisory" : "RHSA-2026:19597",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9",
    "package" : "rhbk/keycloak-rhel9-operator:26.4-17"
  }, {
    "product_name" : "Red Hat build of Keycloak 26.4.12",
    "release_date" : "2026-05-20T00:00:00Z",
    "advisory" : "RHSA-2026:19596",
    "cpe" : "cpe:/a:redhat:build_keycloak:26.4::el9"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Build of Keycloak",
    "fix_state" : "Fix deferred",
    "package_name" : "rhbk/keycloak-operator-bundle",
    "cpe" : "cpe:/a:redhat:build_keycloak:"
  }, {
    "product_name" : "Red Hat Build of Keycloak",
    "fix_state" : "Fix deferred",
    "package_name" : "rhbk/keycloak-rhel9-operator",
    "cpe" : "cpe:/a:redhat:build_keycloak:"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Fix deferred",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Fix deferred",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Fix deferred",
    "package_name" : "keycloak-services",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-4366\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-4366" ],
  "name" : "CVE-2026-4366",
  "mitigation" : {
    "value" : "To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as `169.254.169.254`. For example, on Red Hat Enterprise Linux, you can use `firewalld` to add a rich rule:\n`sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=\"ipv4\" destination address=\"169.254.169.254\" reject'`\n`sudo firewall-cmd --reload`\nThis may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured `sector_identifier_uri` values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.",
    "lang" : "en:us"
  },
  "csaw" : false
}