Keycloak 服务器端请求伪造 (SSRF) 漏洞

The SSRF vulnerability in Keycloak's CIBA feature allows an attacker to craft malicious client configurations that trigger requests to internal services. Because the validation of backchannel notification endpoints is insufficient, an attacker can effectively blind the Keycloak server to the destination of these requests. This could lead to unauthorized access to sensitive internal resources, such as databases, configuration files, or other internal APIs. While the CVSS score is LOW, the potential for lateral movement and data exfiltration within the Keycloak environment should not be underestimated. Exploitation could reveal internal network topology and expose critical infrastructure components.

1. 已保留2026-01-28
2. 发布日期2026-02-02
3. 修改日期2026-02-03
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-1518 is to upgrade Keycloak to a version that includes the fix. Consult the official Keycloak advisory for the specific patched version. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include restricting network access to the Keycloak server using firewalls or network segmentation to limit the potential blast radius of a successful SSRF attack. Carefully review and restrict client configurations to prevent malicious backchannel notification endpoints. Monitor Keycloak logs for unusual outbound requests that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger a CIBA flow with a malicious backchannel URL and verifying that the request is blocked.