CVE-2026-4366

Katalog CVE

CVSS 5.8 · Medium EPSS 0,39%

Kerentanan Server-Side Request Forgery (SSRF) pada redhat build of keycloak, redhat jboss enterprise application platform +2 lainnya. Skor CVSS 3.1 5.8 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.8 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-4366 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2448543 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:19596
• https://access.redhat.com/errata/RHSA-2026:19597