CVE-2026-105301: Keycloak X.509 Authenticator SSRF Vulnerability

CVE-2026-105301 Overview

CVE-2026-105301 is a blind server-side request forgery (SSRF) vulnerability in the X.509 client-certificate authenticator of Keycloak, an open-source identity and access management solution. The flaw occurs when the server is configured to check certificate revocation using Certificate Revocation List (CRL) Distribution Points or the Online Certificate Status Protocol (OCSP). An attacker can submit a specially crafted certificate referencing a malicious endpoint. Keycloak follows those references and issues outbound requests before the certificate is fully validated. This behavior enables unauthenticated attackers to probe internal or external services from the Keycloak host.

Critical Impact
Unauthenticated attackers can coerce Keycloak into issuing arbitrary outbound HTTP or LDAP requests to internal network endpoints, enabling reconnaissance of otherwise unreachable services.

Affected Products

Red Hat Keycloak (X.509 client-certificate authenticator)
Red Hat build of Keycloak
Red Hat Single Sign-On

Discovery Timeline

2026-10-05 - CVE-2026-105301 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105301

Vulnerability Analysis

The vulnerability lives in the X.509 client-certificate authentication flow of Keycloak. When revocation checking is enabled, the authenticator parses CRL Distribution Points or Authority Information Access (OCSP) extensions from the client-supplied certificate. Keycloak then issues outbound requests to the URLs embedded in those extensions. The requests are initiated before the certificate chain and signature are fully validated.

An attacker can present a self-signed or otherwise invalid certificate containing attacker-controlled URLs in these extensions. Keycloak will dereference the URLs regardless of the certificate's trust status. The attacker never needs to authenticate successfully. The result is a blind SSRF primitive the attacker can direct at loopback addresses, cloud metadata services, or internal management APIs. Because the vulnerability is classified under [CWE-918], the server acts as a confused deputy on behalf of the attacker.

Root Cause

The root cause is improper ordering of validation steps in the X.509 authenticator. Revocation lookups fire against untrusted certificate data before the certificate is proven authentic. Any URL that parses as a valid CRLDistributionPoints or OCSP responder URI is treated as safe to fetch.

Attack Vector

The attacker initiates a mutual TLS handshake with the Keycloak endpoint configured for X.509 client authentication. The handshake presents a crafted certificate whose CRLDistributionPoints extension or OCSP responder URL points at an internal resource such as http://169.254.169.254/latest/meta-data/ or http://localhost:8080/admin. Keycloak issues the outbound request from its own network context. The attacker observes the resulting side effects, timing differences, or error messages to infer the state of internal services. No valid credentials or prior authentication are required.

No verified proof-of-concept code is published. See the Red Hat CVE-2026-105301 Advisory and Red Hat Bugzilla #2545797 for technical details.

Detection Methods for CVE-2026-105301

Indicators of Compromise

Unexpected outbound HTTP, HTTPS, or LDAP connections originating from the Keycloak server process to internal RFC1918 ranges or cloud metadata endpoints such as 169.254.169.254.
Keycloak authentication logs showing repeated X.509 authentication attempts with certificates that fail validation but trigger revocation lookups.
DNS resolution requests from the Keycloak host for domains referenced in untrusted client certificates.

Detection Strategies

Correlate failed X.509 authentication events in Keycloak with egress connections from the same host within a short time window.
Baseline normal CRL and OCSP responder destinations for your public key infrastructure (PKI) and alert on deviations.
Inspect submitted client certificates for CRLDistributionPoints or AuthorityInformationAccess URLs that resolve to private IP space or non-PKI hosts.

Monitoring Recommendations

Forward Keycloak event logs and host network telemetry to a centralized analytics platform for correlation.
Monitor for outbound traffic from identity servers to cloud instance metadata services, which identity brokers should never contact.
Alert on spikes in X.509 authentication attempts against endpoints that normally see low volumes of certificate-based logins.

How to Mitigate CVE-2026-105301

Immediate Actions Required

Apply the vendor patch referenced in the Red Hat CVE-2026-105301 Advisory as soon as it is available for your Keycloak distribution.
Restrict egress from Keycloak hosts to only the known CRL and OCSP responders required by your PKI.
Review Keycloak authentication flow configurations and disable X.509 client-certificate authentication on realms that do not require it.

Patch Information

Refer to the Red Hat CVE-2026-105301 Advisory and Red Hat Bugzilla #2545797 for fixed package versions across Red Hat build of Keycloak and Red Hat Single Sign-On. Upgrade all affected realms to a patched release and restart the Keycloak server to apply the fix.

Workarounds

Disable CRL Distribution Point checking and OCSP checking in the X.509 authenticator configuration until a patch is applied, accepting the trade-off in revocation coverage.
Place Keycloak behind an egress proxy that only permits requests to an allow-list of trusted CRL and OCSP responder URLs.
Restrict access to the X.509 authentication endpoint to internal clients using network access controls or a reverse proxy with mutual TLS enforcement.

bash

# Example egress allow-list enforced via iptables on the Keycloak host
# Permit outbound traffic only to known CRL/OCSP responders
iptables -A OUTPUT -p tcp -d crl.example-pki.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d ocsp.example-pki.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -m owner --uid-owner keycloak -j REJECT