CVE-2026-2733: Keycloak Auth Bypass Vulnerability

CVE-2026-2733 Overview

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client "Enabled" setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.

Critical Impact

Administrative controls for disabling Docker registry clients are ineffective, allowing continued token issuance and potential unauthorized access to container registry resources even after explicit administrative action to disable the client.

Affected Products

• Keycloak (Docker v2 authentication endpoint)

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-2733 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-2733

Vulnerability Analysis

This vulnerability is classified as CWE-285 (Improper Authorization), indicating a failure in the authorization mechanism within Keycloak's Docker v2 authentication endpoint. The core issue lies in the disconnect between the administrative "Enabled" toggle for Docker registry clients and the actual token issuance logic.

When an administrator disables a Docker registry client through Keycloak's management interface, the expectation is that authentication requests from that client will be rejected. However, the Docker v2 authentication endpoint does not properly check the client's enabled status before issuing tokens. This creates a dangerous gap between administrative intent and actual system behavior.

The vulnerability has a network-based attack vector, meaning it can be exploited remotely without requiring physical access to the target system. While the impact is limited to confidentiality and integrity concerns without availability impact, it fundamentally undermines the trust administrators place in Keycloak's access control mechanisms.

Root Cause

The root cause of this vulnerability is improper authorization checking in the Docker v2 authentication endpoint code path. The token issuance logic fails to validate the client's administrative status before processing authentication requests. This oversight means the "Enabled" flag in the client configuration is not consulted during the authentication flow, allowing disabled clients to continue receiving valid tokens.

This represents a logic flaw where the enforcement point (token issuance) is not synchronized with the policy point (client enabled status). The Docker v2 authentication endpoint appears to have been implemented without the same authorization checks present in other Keycloak authentication flows.

Attack Vector

The attack scenario requires an attacker to have prior knowledge of valid credentials for a Docker registry client that has been administratively disabled. The attack proceeds through network access to the Keycloak Docker v2 authentication endpoint.

An attacker would authenticate using previously valid credentials for a disabled client, and despite the administrative action to disable the client, Keycloak continues to issue authentication tokens. These tokens can then be used to access container registry resources that should have been restricted when the client was disabled.

This vulnerability is particularly concerning in scenarios where clients are disabled as part of incident response or access revocation procedures. Administrators expecting immediate access termination may be unaware that tokens can still be obtained.

Detection Methods for CVE-2026-2733

Indicators of Compromise

• Successful authentication tokens issued for clients marked as disabled in Keycloak administration console
• Unusual Docker registry access patterns from clients that were recently disabled
• Token issuance activity in Keycloak logs for clients with "Enabled" set to OFF

Detection Strategies

• Monitor Keycloak authentication logs for token issuance events and correlate with client enabled status in the database
• Implement alerting on authentication attempts from clients that have been disabled within a recent time window
• Audit container registry access logs against known disabled client identifiers
• Establish baseline authentication patterns and alert on deviations for administratively disabled clients

Monitoring Recommendations

• Enable detailed logging for the Docker v2 authentication endpoint in Keycloak
• Configure centralized log aggregation to correlate Keycloak token issuance with registry access events
• Implement real-time monitoring for authentication activity from disabled clients using SIEM integration
• Periodically audit token issuance against client enabled status to identify discrepancies

How to Mitigate CVE-2026-2733

Immediate Actions Required

• Review all currently disabled Docker registry clients in Keycloak to assess potential exposure
• Rotate credentials for any Docker registry clients that have been administratively disabled
• Implement additional access controls at the container registry level to enforce client restrictions
• Consider removing disabled clients entirely rather than relying on the "Enabled" toggle

Patch Information

Red Hat has acknowledged this vulnerability. Administrators should monitor the Red Hat CVE-2026-2733 Advisory for patch availability and update information. Additional technical details are available in the Red Hat Bugzilla Report #2440895.

Organizations running Keycloak should subscribe to Red Hat security announcements and apply patches as soon as they become available.

Workarounds

• Delete disabled Docker registry clients from Keycloak instead of toggling the "Enabled" setting to OFF
• Implement network-level access controls to restrict access to the Docker v2 authentication endpoint
• Use registry-side authentication controls as a secondary enforcement layer
• Rotate all client credentials immediately when disabling a Docker registry client to invalidate existing authentication material
• Consider implementing short-lived token policies to reduce the window of potential exploitation