CVE-2026-4366

Vendor solution

To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as `169.254.169.254`. For example, on Red Hat Enterprise Linux, you can use `firewalld` to add a rich rule: `sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" destination address="169.254.169.254" reject'` `sudo firewall-cmd --reload` This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured `sector_identifier_uri` values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.

Red Hat statement

MODERATE impact: Keycloak is vulnerable to a blind Server-Side Request Forgery (SSRF) due to improper handling of HTTP redirects during client configuration. An attacker can exploit this remotely without authentication or user interaction by crafting a `sector_identifier_uri` that redirects to internal resources, potentially leading to information disclosure and internal network reconnaissance.

Red Hat mitigation

To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as `169.254.169.254`. For example, on Red Hat Enterprise Linux, you can use `firewalld` to add a rich rule: `sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" destination address="169.254.169.254" reject'` `sudo firewall-cmd --reload` This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured `sector_identifier_uri` values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.