CVE-2026-4366
Medium
Description
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
SeverityMedium
CVSS5.8
Exploit probability—
Product
Redhat Build Of Keycloak
PublishedMar 18, 2026
First seenMar 18, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build_of_keycloak | No range specified | — |
| redhat jboss_enterprise_application_platform | 8.0.0 | — |
| redhat jboss_enterprise_application_platform_expansion_pack | No range specified | — |
| redhat single_sign-on | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.