CVE-2026-1180: Keycloak SSRF Vulnerability

CVE-2026-1180 Overview

A Server-Side Request Forgery (SSRF) vulnerability was identified in Keycloak's OpenID Connect Dynamic Client Registration feature. The flaw occurs when clients authenticate using private_key_jwt authentication method. The vulnerability allows an attacker to specify an arbitrary jwks_uri parameter, which Keycloak retrieves without proper validation of the destination URL. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources, potentially exposing sensitive internal services and cloud metadata endpoints.

Critical Impact

Attackers can leverage this SSRF vulnerability to probe internal services and cloud metadata endpoints, creating significant information disclosure and reconnaissance risks within the organization's network infrastructure.

Affected Products

• Keycloak (versions with OpenID Connect Dynamic Client Registration enabled)
• Red Hat Single Sign-On (SSO) deployments using Keycloak
• Applications utilizing private_key_jwt client authentication with Keycloak

Discovery Timeline

• 2026-01-20 - CVE-2026-1180 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-1180

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery), affecting Keycloak's OpenID Connect Dynamic Client Registration implementation. The flaw exists in the authentication flow when clients use private_key_jwt as their authentication method.

When a client registers dynamically with Keycloak and specifies a jwks_uri endpoint for JSON Web Key Set retrieval, Keycloak fetches the keys from that URI without validating whether the target is a legitimate external resource or an internal network endpoint. This lack of URL validation creates an SSRF condition that can be exploited for network reconnaissance.

The vulnerability is accessible over the network without requiring authentication, and can affect resources beyond the vulnerable component's security scope. While the vulnerability allows read access to potentially sensitive information, it does not enable modification of data or cause service disruption.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within Keycloak's Dynamic Client Registration endpoint. Specifically, the jwks_uri parameter is not properly validated before Keycloak initiates an HTTP request to retrieve the JSON Web Key Set. The server accepts arbitrary URLs, including those pointing to:

• Internal IP addresses (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x)
• Cloud metadata endpoints (e.g., 169.254.169.254)
• Internal DNS names and services
• Localhost services running on non-standard ports

Attack Vector

The attack vector is network-based and does not require authentication. An attacker can exploit this vulnerability by:

1. Initiating a Dynamic Client Registration request to the Keycloak server
2. Specifying a malicious jwks_uri parameter pointing to an internal resource
3. Using private_key_jwt as the client authentication method
4. Observing the response or timing to determine if the internal resource exists

This allows the attacker to use Keycloak as a proxy to scan internal networks, access cloud provider metadata services (potentially exposing IAM credentials), and enumerate internal services that would otherwise be inaccessible from external networks.

For detailed technical information, refer to the Red Hat CVE Advisory and the Red Hat Bug Report.

Detection Methods for CVE-2026-1180

Indicators of Compromise

• Unusual Dynamic Client Registration requests with suspicious jwks_uri values pointing to internal IP ranges
• Keycloak server making outbound HTTP requests to internal network addresses or cloud metadata endpoints
• Multiple registration attempts with varying jwks_uri parameters indicating reconnaissance activity
• Log entries showing failed or unusual JWKS retrieval attempts to non-standard destinations

Detection Strategies

• Monitor Keycloak logs for Dynamic Client Registration events with private_key_jwt authentication method
• Implement network monitoring to detect outbound connections from Keycloak servers to internal IP ranges (RFC 1918) or cloud metadata IPs
• Configure IDS/IPS rules to alert on requests from Keycloak to sensitive internal endpoints
• Review audit logs for patterns of registration requests from single sources with different jwks_uri values

Monitoring Recommendations

• Enable detailed logging for Keycloak's client registration endpoints
• Set up alerts for outbound connections from Keycloak to internal network segments
• Monitor for access attempts to cloud metadata endpoints (169.254.169.254) from application servers
• Implement network segmentation monitoring to detect lateral movement attempts

How to Mitigate CVE-2026-1180

Immediate Actions Required

• Review and restrict access to Keycloak's Dynamic Client Registration endpoint
• Implement network-level controls to prevent Keycloak from accessing internal resources and cloud metadata endpoints
• Consider disabling Dynamic Client Registration if not required for your deployment
• Apply URL allowlisting for permitted jwks_uri destinations if supported by your Keycloak version

Patch Information

Red Hat has acknowledged this vulnerability. Organizations should monitor the Red Hat CVE Advisory for official patch releases and apply updates as soon as they become available. Subscribe to Red Hat security notifications to receive timely updates about patches for affected products.

Workarounds

• Disable Dynamic Client Registration if it is not required for your environment
• Implement network segmentation to prevent Keycloak from accessing internal networks and cloud metadata services
• Deploy a web application firewall (WAF) with rules to inspect and block suspicious jwks_uri values in registration requests
• Configure outbound firewall rules on Keycloak servers to restrict egress traffic to only necessary external destinations

# Example: Block outbound connections to cloud metadata endpoint using iptables
# Apply this on Keycloak server to prevent SSRF to cloud metadata
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block connections to private IP ranges from Keycloak
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP