CVE-2026-105301: Server-Side Request Forgery (SSRF) in Red Hat Red Hat Build of Keycloak

The vulnerability in Red Hat Build of Keycloak involves the X.509 client-certificate authenticator performing certificate revocation checks via CRL Distribution Points or OCSP. An attacker can exploit this by presenting a specially crafted certificate that directs Keycloak to send unauthorized outbound requests to attacker-controlled or internal network endpoints prior to full certificate validation. This results in a blind SSRF attack, potentially allowing the attacker to interact with internal services indirectly through the Keycloak server.

The impact is limited to a blind SSRF attack that can cause Keycloak to make unauthorized outbound network requests. The CVSS vector indicates the attack requires network access, has high attack complexity, no privileges or user interaction, and results in low confidentiality impact without affecting integrity or availability. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-105301 for current remediation guidance. Until an official fix is available, consider restricting outbound network access from the Keycloak server to limit potential SSRF impact.