CVE-2026-1518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1518", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-01-28T08:08:15.419Z", "datePublished": "2026-02-02T07:17:46.557Z", "dateUpdated": "2026-07-24T14:07:33.181Z", "dateRejected": "2026-07-24T14:07:33.181Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies, including the Secure Client URIs Pattern executor. Therefore, this CVE has been rejected."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-24T14:07:33.181Z"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1518", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-01-28T08:08:15.419Z", "datePublished": "2026-02-02T07:17:46.557Z", "dateUpdated": "2026-07-24T14:07:33.181Z", "dateRejected": "2026-07-24T14:07:33.181Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies, including the Secure Client URIs Pattern executor. Therefore, this CVE has been rejected."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-24T14:07:33.181Z"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies, including the Secure Client URIs Pattern executor. Therefore, this CVE has been rejected."}], "id": "CVE-2026-1518", "lastModified": "2026-07-24T15:17:13.450", "metrics": {}, "published": "2026-02-02T08:16:06.217", "references": [], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Rejected"}

{"acknowledgement": "Red Hat would like to thank Patrick Smith for reporting this issue.", "bugzilla": {"description": "keycloak: Blind Server-Side Request Forgery (SSRF) via CIBA Backchannel Notification Endpoint in Keycloak", "id": "2433727", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433727"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Keycloak\u2019s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict administrative access to Keycloak instances. Ensure that only trusted and authorized personnel have the necessary privileges to configure client settings, including the backchannel_client_notification_endpoint. This limits the ability of an attacker to manipulate the endpoint for SSRF attacks."}, "name": "CVE-2026-1518", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-operator-bundle", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}], "public_date": "2026-01-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-1518\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1518"], "statement": "This LOW impact flaw in Red Hat Build of Keycloak allows a highly privileged attacker to perform blind Server-Side Request Forgery (SSRF). By configuring the CIBA backchannel notification endpoint to an internal URL, an attacker can induce Keycloak to send requests to arbitrary internal services. Exploitation requires administrative access or a valid Initial Access Token to configure client settings.", "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T00:43:00.423287+00:00", "value": {"mitigation_remediation": ["Restrict administrative access to Keycloak, ensuring only trusted personnel can configure client settings, particularly the backchannel_client_notification_endpoint.", "Implement input validation on the backchannel notification endpoint configuration to reject or sanitize untrusted URLs, addressing the underlying CWE\u2011918 flaw.", "Monitor Keycloak logs for unexpected outbound HTTP traffic and block or quarantine suspicious destinations."], "summary": {"action": "Apply workaround", "impact": "Blinded SSRF via unvalidated backchannel notification endpoint"}, "threat_synthesis": {"affected_systems": "Red Hat Build of Keycloak is affected. No specific version information is available in the advisory.", "description_and_impact": "Insufficient validation of client\u2011configured backchannel notification endpoints in Keycloak\u2019s CIBA feature allows an attacker to cause the server to make blind HTTP requests to internal services. Because the responses are not returned to the attacker, the vulnerability is a blind server\u2011side request forgery (SSRF) that can expose internal network endpoints or serve as a foothold for further exploitation, compromising the confidentiality and integrity of internal infrastructure.", "risk_and_exploitability": "The CVSS score of 2.7 indicates low overall risk, and the EPSS score of <1% shows very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attacks would target the backchannel_client_notification_endpoint, generating outbound requests from the Keycloak server to any URL supplied by a client, potentially reaching internal services that are otherwise inaccessible."}}}}, "created": "2026-04-18T00:45:32.245604+00:00", "updated": "2026-04-18T00:45:32.245617+00:00", "vendors": []}