CVE-2026-1518: Keycloak CIBA SSRF Vulnerability

CVE-2026-1518 Overview

A flaw was found in Keycloak's CIBA (Client Initiated Backchannel Authentication) feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services. This Server-Side Request Forgery (SSRF) vulnerability enables attackers with high privileges to make unauthorized requests from the Keycloak server to internal network resources.

Critical Impact

Privileged attackers can abuse the CIBA backchannel notification endpoint configuration to perform blind SSRF attacks, potentially probing internal services and network infrastructure that should not be accessible from the authentication server.

Affected Products

• Keycloak (versions with CIBA feature enabled)

Discovery Timeline

• 2026-02-02 - CVE-2026-1518 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-1518

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw exists in Keycloak's implementation of the CIBA (Client Initiated Backchannel Authentication) OpenID Connect extension. CIBA allows clients to initiate authentication flows where the authentication device is decoupled from the device initiating the request, using backchannel notifications to communicate authentication results.

The vulnerability stems from insufficient validation of the backchannel notification endpoints that clients can configure. When a client specifies a callback URL for receiving authentication notifications, Keycloak does not adequately validate or restrict these URLs, allowing attackers with client configuration privileges to specify internal network addresses as notification endpoints.

Root Cause

The root cause is improper input validation in the CIBA backchannel notification endpoint configuration mechanism. Keycloak fails to implement proper URL allowlisting or blocking of internal network ranges (such as 127.0.0.1, localhost, 10.x.x.x, 172.16.x.x, 192.168.x.x, and cloud metadata endpoints) when processing client-configured notification URLs. This allows the server to be tricked into making requests to arbitrary internal resources.

Attack Vector

The attack vector is network-based and requires high privileges (administrative or client configuration access). An attacker with the ability to configure CIBA client settings can:

1. Register or modify a client with CIBA capabilities
2. Set the backchannel notification endpoint to an internal service URL
3. Initiate CIBA authentication flows
4. Force the Keycloak server to make HTTP requests to the specified internal endpoint

While this is a blind SSRF (the attacker cannot directly see the responses), it can still be exploited to:

• Probe internal network services and map infrastructure
• Interact with internal APIs that accept HTTP requests
• Access cloud provider metadata services (e.g., AWS IMDSv1, GCP metadata)
• Potentially trigger actions on internal services that don't require authentication

Due to the requirement for high privileges, exploitation in production environments would typically require a compromised administrator account or misconfigured access controls on client registration.

Detection Methods for CVE-2026-1518

Indicators of Compromise

• Unusual CIBA client configurations with backchannel notification endpoints pointing to internal IP addresses or localhost
• Authentication logs showing CIBA flows with notification URLs targeting RFC 1918 private address ranges
• Network traffic from Keycloak servers to unexpected internal destinations
• Cloud metadata endpoint access attempts originating from the Keycloak server

Detection Strategies

• Monitor Keycloak audit logs for client configuration changes, particularly modifications to CIBA-related settings
• Implement network monitoring to detect outbound connections from Keycloak to internal services that should not normally receive traffic
• Review client registration configurations periodically for suspicious backchannel notification URLs
• Deploy web application firewalls (WAF) with SSRF detection capabilities in front of Keycloak instances

Monitoring Recommendations

• Enable verbose logging for CIBA authentication flows in Keycloak
• Configure alerts for client configuration changes involving backchannel authentication settings
• Monitor for requests to cloud metadata endpoints from identity infrastructure
• Implement egress filtering and logging on Keycloak server network segments

How to Mitigate CVE-2026-1518

Immediate Actions Required

• Review all existing CIBA client configurations and validate backchannel notification endpoints
• Restrict administrative access to Keycloak client configuration functions
• Implement network segmentation to limit Keycloak's ability to reach sensitive internal services
• Consider disabling the CIBA feature if not actively used in your deployment

Patch Information

Consult the Red Hat CVE-2026-1518 Advisory for official patch information and updated Keycloak versions that address this vulnerability. Additional technical details can be found in Red Hat Bugzilla Entry #2433727.

Workarounds

• Implement network-level controls to prevent the Keycloak server from connecting to internal network ranges
• Use a reverse proxy with URL filtering to block requests to internal addresses from the CIBA notification mechanism
• Restrict client registration and modification capabilities to trusted administrators only
• If CIBA functionality is not required, disable it at the realm level to eliminate the attack surface

# Network-level mitigation: Block outbound connections to internal ranges from Keycloak
# Example iptables rules (adjust interface and IPs as needed)
iptables -A OUTPUT -s <keycloak_server_ip> -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -s <keycloak_server_ip> -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -s <keycloak_server_ip> -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -s <keycloak_server_ip> -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -s <keycloak_server_ip> -d 169.254.169.254 -j DROP