CVE-2026-4874: Redhat Keycloak SSRF Vulnerability

CVE-2026-4874 Overview

CVE-2026-4874 is a Server-Side Request Forgery (SSRF) vulnerability in Red Hat Keycloak. An authenticated attacker can manipulate the client_session_host parameter during refresh token requests to coerce the Keycloak server into issuing outbound HTTP requests. The flaw is triggered when a Keycloak client is configured with the backchannel.logout.url setting containing the application.session.host placeholder. Successful exploitation enables probing of internal networks and APIs reachable from the Keycloak server, leading to information disclosure. The weakness is classified under CWE-918.

Critical Impact
Authenticated attackers can issue arbitrary HTTP requests from the Keycloak server's network context, exposing internal services and metadata endpoints.

Affected Products

Red Hat Build of Keycloak
Red Hat JBoss Enterprise Application Platform 8.0.0 and JBoss EAP Expansion Pack
Red Hat Single Sign-On 7.0

Discovery Timeline

2026-03-26 - CVE-2026-4874 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-4874

Vulnerability Analysis

The vulnerability resides in Keycloak's refresh token handling logic. When a client is configured with backchannel.logout.url containing the application.session.host placeholder, Keycloak substitutes the placeholder with the value supplied in the client_session_host request parameter. The server does not validate or restrict the supplied host value before issuing the backchannel HTTP request.

An authenticated attacker submits a refresh token request that includes an attacker-controlled client_session_host value. Keycloak then performs an outbound HTTP request to the attacker-specified destination using its own network context. This allows the attacker to reach hosts that are otherwise inaccessible from the public internet, such as internal services, cloud metadata endpoints, or administrative APIs.

The attack vector is network-based and requires low privileges, but exploitation complexity is high because the targeted client must be configured with the specific placeholder-based backchannel logout URL.

Root Cause

The root cause is insufficient validation of user-controlled input that is interpolated into a server-side HTTP request URL. Keycloak trusts the client_session_host parameter without enforcing an allowlist or matching it against the originally registered client host.

Attack Vector

Exploitation requires an authenticated session and a vulnerable client configuration. The attacker sends a crafted refresh token request to the token endpoint, setting client_session_host to an internal hostname or IP address. Keycloak resolves and contacts the supplied host as part of backchannel logout processing, returning observable behavior such as timing differences or response characteristics that disclose internal network topology.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-4874 Advisory and Red Hat Bug Report #2451611 for vendor technical details.

Detection Methods for CVE-2026-4874

Indicators of Compromise

Refresh token requests containing unexpected or internal hostnames in the client_session_host parameter.
Outbound HTTP connections from the Keycloak server to RFC1918 addresses, link-local ranges, or cloud metadata endpoints such as 169.254.169.254.
Keycloak access logs showing high-frequency token refresh activity from a single authenticated principal.

Detection Strategies

Parse Keycloak access and event logs for refresh token requests and extract the client_session_host parameter for anomaly review.
Correlate authenticated user sessions with outbound network flows originating from the Keycloak server to identify unauthorized destinations.
Inspect client configurations for backchannel.logout.url values containing the application.session.host placeholder and flag them for review.

Monitoring Recommendations

Enable verbose Keycloak event logging for REFRESH_TOKEN and LOGOUT events and forward them to a centralized analytics platform.
Monitor egress traffic from Keycloak hosts and alert on connections to private network ranges or cloud metadata services.
Track authenticated users that trigger an unusually high volume of refresh token operations against vulnerable clients.

How to Mitigate CVE-2026-4874

Immediate Actions Required

Audit all Keycloak clients and identify any using backchannel.logout.url with the application.session.host placeholder.
Apply Red Hat security updates for Build of Keycloak, JBoss EAP, JBoss EAP Expansion Pack, and Red Hat Single Sign-On as they become available.
Restrict egress network access from Keycloak servers using firewall rules that deny traffic to internal subnets and cloud metadata endpoints.

Patch Information

Red Hat tracks remediation through the Red Hat CVE-2026-4874 Advisory and Red Hat Bug Report #2451611. Administrators should consult these resources for fixed package versions and errata aligned to their deployed Red Hat product channels.

Workarounds

Remove the application.session.host placeholder from the backchannel.logout.url configuration on affected clients and substitute a static, validated hostname.
Apply network segmentation so the Keycloak server cannot reach internal management interfaces, databases, or instance metadata services.
Enforce strict client registration policies and review existing client configurations for placeholder-based URLs.

bash

# Identify Keycloak clients with vulnerable backchannel configuration
# Replace REALM and TOKEN with appropriate values
curl -s -H "Authorization: Bearer ${TOKEN}" \
  "https://keycloak.example.com/admin/realms/${REALM}/clients" \
  | jq '.[] | select(.attributes."backchannel.logout.url" 
        | test("application.session.host")) 
        | {clientId, url: .attributes."backchannel.logout.url"}'