CVE-2026-4874: SSRF in Keycloak Services

The SSRF vulnerability in Keycloak Services allows an attacker, once authenticated, to initiate HTTP requests from the Keycloak server's network. This means the attacker can potentially scan internal networks and access internal APIs that are not directly accessible from the outside world. The impact ranges from information disclosure – revealing details about internal services and infrastructure – to potentially gaining access to sensitive data stored within those internal systems. While the CVSS score is LOW, the potential for internal reconnaissance and lateral movement should not be underestimated, especially in environments with complex internal network architectures. This vulnerability shares similarities with other SSRF exploits where attackers leverage trusted internal access to bypass security controls.

1. Reserved2026-03-26
2. Published2026-03-26
3. Modified2026-04-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-4874 is to upgrade Keycloak Services to a version where the vulnerability has been addressed. Consult the official Keycloak advisory for the specific fixed version. If immediate upgrading is not possible, a temporary workaround involves carefully reviewing and restricting the backchannel.logout.url configuration. Ensure that the application.session.host placeholder is not used in conjunction with untrusted input. Consider implementing network segmentation to limit the potential blast radius of a successful SSRF attack. WAF rules can be configured to block suspicious outbound requests originating from the Keycloak server.