CVE-2026-2733
Authentication Bypass in Keycloak Docker v2 Endpoint Enables Unauthorized Access
Publication date: 2026-02-19
Last updated on: 2026-03-05
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| keycloak | keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'This vulnerability is an improper authorization flaw in the Docker v2 authentication endpoint of Keycloak. Specifically, the server does not check if a Docker registry client is enabled before issuing access tokens. Even if a client has been administratively disabled, the endpoint will still issue valid authentication tokens when valid user credentials and the disabled client\'s ID are presented. This means that turning off the client\'s "Enabled" setting does not fully prevent access.'}, {'type': 'paragraph', 'content': 'As a result, previously valid credentials can still be used to obtain authentication tokens, bypassing intended administrative restrictions.'}] [1]
How can this vulnerability impact me? :
This vulnerability weakens administrative controls by allowing authentication tokens to be issued even for disabled clients. Consequently, authenticated users may gain unauthorized access to container registry resources that should have been restricted.
This could lead to unintended access to sensitive container images or data stored in the registry, potentially compromising security.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know