CVE-2026-4366

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4366
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2026-4366 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448543 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
History

01 Apr 2026, 15:10

Type Values Removed Values Added
CPE cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*
First Time Redhat
Redhat jboss Enterprise Application Platform
Redhat single Sign-on
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat build Of Keycloak
References () https://access.redhat.com/security/cve/CVE-2026-4366 - () https://access.redhat.com/security/cve/CVE-2026-4366 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2448543 - () https://bugzilla.redhat.com/show_bug.cgi?id=2448543 - Issue Tracking, Vendor Advisory

18 Mar 2026, 14:52

Type Values Removed Values Added
Summary
  • (es) Se identificó una vulnerabilidad en Keycloak, una solución de gestión de identidades y accesos, donde sigue incorrectamente las redirecciones HTTP al procesar ciertas solicitudes de configuración del cliente. Este comportamiento permite a un atacante engañar al servidor para que realice solicitudes no intencionadas a recursos internos o restringidos. Como resultado, servicios internos sensibles como los puntos finales de metadatos en la nube podrían ser accedidos. Este problema puede llevar a la revelación de información y permitir a los atacantes mapear la infraestructura de red interna.

18 Mar 2026, 04:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 04:17

Updated : 2026-04-01 15:10

NVD link : CVE-2026-4366

Mitre link : CVE-2026-4366

CVE.ORG link : CVE-2026-4366

JSON object : View

Products Affected

redhat

  • single_sign-on
  • jboss_enterprise_application_platform_expansion_pack
  • jboss_enterprise_application_platform
  • build_of_keycloak
CWE
CWE-918

Server-Side Request Forgery (SSRF)