CVE-2026-4366
Open Redirect in Keycloak Enables Internal Network Information Disclosure
Publication date: 2026-03-18
Last updated on: 2026-04-01
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | single_sign-on | 7.0 |
| redhat | jboss_enterprise_application_platform_expansion_pack | * |
| redhat | jboss_enterprise_application_platform | 8.0.0 |
| redhat | build_of_keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4366 is a Server-Side Request Forgery (SSRF) vulnerability in Keycloak, an identity and access management solution. The flaw arises because Keycloak improperly follows HTTP redirects when processing certain client configuration requests, specifically when handling HTTP redirect responses like HTTP 302 without validating the final destination URL.
An attacker can exploit this by providing a specially crafted sector_identifier_uri that initially appears valid but redirects Keycloak to internal or restricted network resources, such as cloud metadata service endpoints (e.g., 169.254.169.254). This causes Keycloak to make unintended requests from its own network context, leading to a blind SSRF scenario.
How can this vulnerability impact me? :
This vulnerability allows attackers to trick Keycloak into making unintended requests to internal or restricted resources within its network environment. As a result, attackers can access sensitive internal services such as cloud metadata endpoints.
The impact includes potential information disclosure and the ability for attackers to perform internal network reconnaissance, mapping internal network infrastructure. This can increase the risk of further attacks or exploitation of internal systems.
The vulnerability can be exploited remotely without requiring authentication or user interaction, making it easier for attackers to leverage.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves Keycloak improperly following HTTP redirects during client configuration processing, leading to Server-Side Request Forgery (SSRF). Detection involves monitoring Keycloak logs and network traffic for unusual outbound requests to internal or restricted IP addresses, such as cloud metadata service endpoints (e.g., 169.254.169.254).'}, {'type': 'paragraph', 'content': 'You can check Keycloak server logs for HTTP 3xx redirect responses and subsequent requests to internal IPs. Additionally, network monitoring tools can be used to detect unexpected outbound HTTP requests originating from the Keycloak server.'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': "Use grep to find redirect handling in Keycloak logs: `grep -i '302' /path/to/keycloak/logs/server.log`"}, {'type': 'list_item', 'content': 'Monitor outbound connections from the Keycloak server to internal IPs: `sudo netstat -anp | grep ESTABLISHED | grep keycloak`'}, {'type': 'list_item', 'content': 'Use tcpdump to capture HTTP traffic from Keycloak to internal addresses: `sudo tcpdump -i eth0 host 169.254.169.254 and port 80`'}] [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should prevent Keycloak from following unvalidated HTTP redirects during client configuration processing.
Immediate steps include:
- Apply any available patches or updates from Keycloak or your Linux distribution that address this SSRF issue.
- Restrict network access from the Keycloak server to sensitive internal resources, such as cloud metadata endpoints (e.g., 169.254.169.254), using firewall rules or network segmentation.
- Review and validate all client configuration URLs, especially sector_identifier_uri values, to ensure they do not redirect to internal or restricted addresses.
- Monitor Keycloak logs and network traffic for suspicious redirect behavior or unexpected outbound requests.