CVE-2026-18206: Keycloak Auth Bypass Vulnerability

CVE-2026-18206 Overview

CVE-2026-18206 is an input validation flaw [CWE-20] in the keycloak-services component of Keycloak, the open source identity and access management platform. Realm administrators can define wildcard domains such as *.example.com to restrict which hosts are permitted to register or update clients. The affected code accepts any hostname that ends with the configured suffix, without verifying that the value is a legitimate subdomain. An attacker who controls the reverse DNS of their connection can craft a hostname like attackerexample.com and bypass the host-based restriction. Successful exploitation permits unauthorized client registration or modification within the targeted realm.

Critical Impact
Attackers who control reverse DNS for their source address can bypass wildcard host restrictions in Keycloak and perform unauthorized client registration or update operations.

Affected Products

Red Hat Keycloak (keycloak-services component)
Red Hat build of Keycloak
Upstream Keycloak identity and access management server

Discovery Timeline

2026-07-31 - CVE-2026-18206 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18206

Vulnerability Analysis

The flaw resides in the host-based restriction logic used by keycloak-services when a realm administrator supplies a wildcard domain to constrain client registration or update requests. The intended behavior is to accept only hostnames that are legitimate subdomains of the configured domain. Instead, the validator performs a suffix match on the hostname string. Any hostname ending in the configured suffix is treated as authorized, regardless of whether the character preceding the suffix is a . label separator.

An attacker who can influence the reverse DNS record returned for their client IP address can present a hostname such as evilexample.com and pass the check for the wildcard rule *.example.com. The vulnerability requires a network path to the Keycloak endpoint and the ability to control reverse DNS. It affects the integrity of client configuration data within the realm.

Root Cause

The root cause is improper input validation [CWE-20] in the wildcard domain matcher. The comparison relies on a string suffix check rather than parsing the hostname into DNS labels and confirming that the label boundary aligns with the wildcard position. This design accepts hostnames that share the suffix without being subdomains.

Attack Vector

The attack is network-based and requires no authentication or user interaction, but exploitation is conditional on the attacker controlling the reverse DNS lookup of their source IP. The adversary configures a PTR record that resolves to a hostname ending with the target realm's configured suffix. When Keycloak resolves the client hostname during a client registration or update request, the crafted name passes the wildcard filter and the operation is permitted.

No verified public exploit code is available. The Red Hat advisory and Bugzilla report describe the issue in prose. See the Red Hat CVE-2026-18206 Advisory and the Red Hat Bug #2508292 Report for vendor details.

Detection Methods for CVE-2026-18206

Indicators of Compromise

Client registration or update requests originating from IP addresses whose PTR records resolve to unexpected hostnames that share a suffix with an allow-listed domain.
Keycloak audit log entries showing CLIENT_REGISTER or CLIENT_UPDATE events from source addresses outside the expected corporate DNS space.
Mismatches between the forward and reverse DNS resolution of source hosts interacting with client registration endpoints.

Detection Strategies

Enable Keycloak admin event logging and alert on client create or update events that do not correlate with change-management tickets.
Perform forward-confirmed reverse DNS (FCrDNS) validation on hostnames used in access decisions and flag hosts where the forward lookup does not match the source IP.
Baseline the set of hostnames and IP ranges that legitimately manage clients per realm and alert on deviations.

Monitoring Recommendations

Ship Keycloak admin and event logs to a centralized analytics platform for correlation with DNS telemetry.
Monitor DNS resolver logs for PTR lookups tied to client registration endpoints and investigate responses that land on unexpected domains.
Review realm configurations periodically for wildcard host rules and confirm they still reflect intended trust boundaries.

How to Mitigate CVE-2026-18206

Immediate Actions Required

Apply the fixed Keycloak release referenced in the Red Hat CVE-2026-18206 Advisory as soon as it is available for your distribution.
Audit each realm for wildcard host restrictions and confirm that no unauthorized clients were registered or modified.
Restrict which networks can reach Keycloak client registration and admin endpoints using firewall or reverse proxy rules.

Patch Information

Red Hat tracks remediation for this issue under Bugzilla entry 2508292. Consult the Red Hat CVE-2026-18206 Advisory and the Red Hat Bug #2508292 Report for fixed package versions and errata specific to your Keycloak or Red Hat build of Keycloak deployment.

Workarounds

Replace wildcard host restrictions with an explicit allow list of fully qualified hostnames or IP addresses where feasible.
Terminate client registration traffic behind a reverse proxy that enforces IP-based access control independent of reverse DNS.
Disable dynamic client registration on realms that do not require it until the patched release is deployed.

bash

# Configuration example: restrict client registration exposure at the reverse proxy
# nginx snippet limiting the Keycloak client-registration endpoint to trusted CIDRs
location /realms/myrealm/clients-registrations/ {
    allow 10.0.0.0/8;
    allow 192.168.10.0/24;
    deny  all;
    proxy_pass http://keycloak_upstream;
}