Description

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.

INFO

Published Date :

2026-03-18T04:02:59.959Z

Last Modified :

2026-03-18T17:58:48.644Z

Source :

redhat
AFFECTED PRODUCTS

The following products are affected by CVE-2026-4366 vulnerability.

Vendors Products
Redhat
  • Build Keycloak
  • Build Of Keycloak
  • Jboss Enterprise Application Platform
  • Jboss Enterprise Application Platform Expansion Pack
  • Jbosseapxp
  • Red Hat Single Sign On
  • Single Sign-on
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-4366.

URL Resource
https://access.redhat.com/security/cve/CVE-2026-4366 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2448543 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-4366 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-4366 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact