CVE-2026-1518: SSRF in Keycloak CIBA Feature

The SSRF vulnerability in Keycloak's CIBA feature allows an attacker to craft malicious client configurations that trigger requests to internal services. Because the validation of backchannel notification endpoints is insufficient, an attacker can effectively blind the Keycloak server to the destination of these requests. This could lead to unauthorized access to sensitive internal resources, such as databases, configuration files, or other internal APIs. While the CVSS score is LOW, the potential for lateral movement and data exfiltration within the Keycloak environment should not be underestimated. Exploitation could reveal internal network topology and expose critical infrastructure components.

1. Reserved2026-01-28
2. Published2026-02-02
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1518 is to upgrade Keycloak to a version that includes the fix. Consult the official Keycloak advisory for the specific patched version. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include restricting network access to the Keycloak server using firewalls or network segmentation to limit the potential blast radius of a successful SSRF attack. Carefully review and restrict client configurations to prevent malicious backchannel notification endpoints. Monitor Keycloak logs for unusual outbound requests that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger a CIBA flow with a malicious backchannel URL and verifying that the request is blocked.