CVE-2026-1180: 
Java vulnerability analysis and mitigation

CVE-2026-1180 is a Blind Server-Side Request Forgery (SSRF) vulnerability in Keycloak's OpenID Connect Dynamic Client Registration feature, specifically when clients authenticate using private_key_jwt. The flaw allows an attacker to supply an arbitrary jwks_uri during client registration, which Keycloak fetches without validating the destination, enabling coercion of the server into making HTTP requests to internal or restricted network resources. It affects Keycloak and Red Hat build of Keycloak (fixed in version 26.4.11 and upstream 26.5.6). The vulnerability was reported on January 19, 2026, and publicly disclosed on January 20, 2026, with patches released on April 2, 2026. It carries a CVSS v3.1 base score of 5.8 (Medium), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from the absence of validation or restriction on the jwks_uri parameter supplied during OpenID Connect Dynamic Client Registration (Red Hat Bugzilla). When a client registers and later authenticates using private_key_jwt, Keycloak automatically fetches the JSON Web Key Set (JWKS) from the attacker-controlled URI via a server-side HTTP request. Exploitation requires the ability to register a client — either anonymously or with a token, depending on the Keycloak realm configuration — and no user interaction is needed. Although responses from the fetched URI are not directly returned to the attacker, internal network enumeration is possible through timing differences and error behavior (blind SSRF) (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows an attacker to probe internal services, RFC1918 addresses, localhost services, and cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) from the Keycloak server's network perspective, creating an information disclosure and internal reconnaissance risk. The confidentiality impact is limited (low), with no integrity or availability impact, but the changed scope indicates the vulnerability crosses a security boundary beyond the vulnerable component itself. In cloud-hosted or containerized deployments, this could expose sensitive instance metadata or internal microservices not otherwise reachable from the internet (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify a publicly accessible Keycloak instance with OpenID Connect Dynamic Client Registration enabled. Determine whether anonymous or token-based client registration is permitted by querying the realm's .well-known/openid-configuration endpoint.
2. Register a malicious client: Submit a Dynamic Client Registration request (HTTP POST to /realms/{realm}/clients-registrations/openid-connect) with a crafted payload that sets jwks_uri to an attacker-controlled or internal target URL (e.g., http://169.254.169.254/latest/meta-data/ or http://internal-service/).
3. Trigger JWKS fetch: Authenticate as the registered client using private_key_jwt grant type, causing Keycloak to automatically issue an HTTP GET request to the specified jwks_uri.
4. Infer internal network topology: Monitor timing differences, HTTP error codes, or out-of-band DNS/HTTP callbacks (e.g., using Burp Collaborator or interactsh) to determine which internal hosts and ports are reachable from the Keycloak server, enabling blind internal network enumeration (Red Hat Bugzilla, Red Hat CVE).

• Network: Outbound HTTP/HTTPS requests from the Keycloak server to internal RFC1918 addresses, localhost, or cloud metadata endpoints (e.g., 169.254.169.254); unexpected DNS lookups or HTTP requests to external out-of-band callback domains originating from the Keycloak process.
• Logs: Keycloak server logs showing repeated client registration requests with unusual or internal jwks_uri values; HTTP client errors or timeouts in Keycloak logs corresponding to fetch attempts against internal hosts.
• Application: Presence of newly registered OIDC clients with jwks_uri values pointing to internal IP ranges, localhost, or cloud metadata endpoints in the Keycloak admin console or database.

Red Hat released patches addressing CVE-2026-1180 in Red Hat build of Keycloak 26.4.11 (packages and container images, RHSA-2026:6477 and RHSA-2026:6478, issued April 2, 2026) (RHSA-2026:6477, RHSA-2026:6478). The upstream Keycloak project addressed the issue in version 26.5.6 (Keycloak Release). As a workaround, administrators should disable OpenID Connect Dynamic Client Registration if not required, or restrict client registration to authenticated and authorized users only to reduce the attack surface (Red Hat CVE).