CVE-2026-15573: Keycloak Authorization Bypass Vulnerability

CVE-2026-15573 Overview

CVE-2026-15573 is an authorization bypass vulnerability in Keycloak's Authorization Services. The PathMatcher component fails to normalize request URIs before comparing them against configured security policies. Attackers append characters such as trailing slashes or matrix parameters to a request path. The modified path evades the intended policy match and resolves to a weaker rule.

An authenticated user can leverage this behavior to reach administrative or restricted endpoints. The weakness maps to CWE-178: Improper Handling of Case Sensitivity, applied here to URI normalization inconsistencies.

Critical Impact
An authenticated attacker can bypass Keycloak authorization policies and access administrative resources by manipulating request URIs.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE Analysis CVE-2026-15573)
Red Hat Single Sign-On distributions covered by RHSA-2026:50846 and RHSA-2026:50847
Additional Red Hat components addressed in RHSA-2026:50848 and RHSA-2026:50849

Discovery Timeline

2026-08-05 - CVE-2026-15573 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15573

Vulnerability Analysis

Keycloak's Authorization Services enforce fine-grained access rules by mapping HTTP request paths to resource-based policies. The PathMatcher component performs this mapping. It compares the incoming request path against configured resource path patterns without first applying URI normalization.

When a request arrives with extra syntactic elements, the matcher treats the string as a different path. The engine falls back to a broader or less restrictive rule. That fallback rule grants access that the intended policy would have denied.

The vulnerability requires an authenticated session but no user interaction. Confidentiality and integrity impact are high because bypassed policies frequently guard administrative functions. The Red Hat analysis is tracked in Bug Report #2499593.

Root Cause

The root cause is missing URI canonicalization inside PathMatcher. The matcher does not strip or normalize trailing slashes, matrix parameters, or equivalent syntactic variations before pattern comparison. Two paths that resolve to the same resource on the server are treated as distinct inputs by the policy engine.

Attack Vector

The attack vector is remote over the network. An authenticated attacker sends a crafted HTTP request to a protected endpoint. The attacker appends a trailing slash such as /admin/realms/master/ or attaches matrix parameters like /admin/realms/master;jsessionid=x. PathMatcher misclassifies the request, and Keycloak returns the protected resource.

Exploitation is described in prose only. No verified proof-of-concept code is available in the referenced sources. Refer to the Red Hat advisories linked above for further technical detail.

Detection Methods for CVE-2026-15573

Indicators of Compromise

Requests to Keycloak administrative paths that contain trailing slashes, matrix parameters, or duplicate path separators combined with successful 200 OK responses.
Access log entries where low-privileged authenticated principals reach /admin/, /realms/*/admin, or Authorization Services resource URLs.
Sequential requests from the same session probing multiple variants of the same URI pattern.

Detection Strategies

Compare Keycloak access logs against configured authorization policies to surface requests that succeeded despite non-canonical paths.
Alert on any HTTP request to Keycloak whose path contains ;, //, or a trailing / on endpoints that normally reject such formats.
Correlate authentication events with authorization decisions to identify accounts accessing resources outside their assigned roles.

Monitoring Recommendations

Enable Keycloak audit events for ADMIN_ACTION and resource-level policy decisions, then forward them to a centralized log platform.
Monitor upstream reverse proxies for URI patterns that differ from the canonical form expected by application services.
Track policy evaluation metrics for anomalous shifts in PERMIT decisions on administrative resources.

How to Mitigate CVE-2026-15573

Immediate Actions Required

Apply the Keycloak updates published in RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849.
Audit Authorization Services resource definitions and confirm each protected path has an explicit deny-by-default policy.
Review recent access logs for successful requests to administrative endpoints from non-administrative accounts.

Patch Information

Red Hat has released fixed builds through the RHSA-2026:50846 through RHSA-2026:50849 advisories. Consult the Red Hat CVE Analysis for CVE-2026-15573 for the mapping between product streams and fixed versions.

Workarounds

Deploy a reverse proxy in front of Keycloak that normalizes URIs by stripping trailing slashes and matrix parameters before forwarding.
Restrict network access to administrative Keycloak endpoints through allowlists or a bastion path until patches are applied.
Tighten role-based access control so that fewer authenticated users can reach resources governed by Authorization Services policies.

bash

# Example NGINX normalization in front of Keycloak
location / {
    rewrite ^(.*?);.*$ $1 last;      # strip matrix parameters
    rewrite ^(.+)/$ $1 permanent;    # strip trailing slash
    proxy_pass http://keycloak_upstream;
}