CVE-2026-4366
published 2026-03-18CVE-2026-4366: A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client…
PriorityP433medium5.8CVSS 3.1
AVNACLPRNUINSCCLINAN
EPSS
0.23%
13.5th percentile
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.15.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
vendor_redhat·2026-03-18·CVSS 5.8
CVE-2026-4366 [MEDIUM] CWE-918 keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an
GHSA
GHSA-g2qr-3mxm-86jj: A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain clie
ghsa_unreviewed·2026-03-18
CVE-2026-4366 [MEDIUM] CWE-918 GHSA-g2qr-3mxm-86jj: A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain clie
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-4366 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-4366 [HIGH] CVE-2026-4366 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-4366 :
JBoss EAP vulnerability analysis and mitigation
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Source : NVD
## 5.8
Score
Published March 18, 2026
Severity MEDIUM
CNA Score 5.8
Affected Technologies
JBoss EAP
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitati
Bugzilla
CVE-2026-4366 keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
bugzilla·2026-03-18·CVSS 5.8
CVE-2026-4366 [MEDIUM] CVE-2026-4366 keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
CVE-2026-4366 keycloak-services: Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
Server-Side Request Forgery (SSRF) vulnerability in Keycloak due to improper handling of HTTP redirects during client configuration processing. The flaw arises because Keycloak follows redirect responses (e.g., HTTP 302) without validating the final destination URL. An attacker can supply a crafted sector_identifier_uri that initially matches allowed patterns but redirects to internal resources such as cloud metadata endpoints (e.g., 169.254.169.254). This causes Keycloak to issue unintended requests from its network context, enabling blind SSRF. The vulnerability can be exploited remotely without authentication or user interaction, allowing attackers to perform internal networ
2026-03-18
Published