CVE-2026-2733: 
Java vulnerability analysis and mitigation

CVE-2026-2733 is an improper authorization vulnerability in the Docker v2 authentication endpoint (/protocol/docker-v2/auth) of Keycloak, classified as "Missing Check on Disabled Client for Docker Registry Protocol." The flaw allows authentication tokens to continue being issued for administratively disabled Docker registry clients, effectively bypassing the "Enabled: OFF" administrative control. It affects the org.keycloak/keycloak-services component and was disclosed on February 19, 2026. The vulnerability carries a CVSS v3.1 base score of 3.8 (Low), though Red Hat's advisory rates the broader update as Important (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-285 (Improper Authorization): Keycloak's Docker v2 authentication endpoint fails to validate whether the requesting client has been administratively disabled before minting an access token. When a client's "Enabled" setting is toggled to OFF, the server does not enforce this restriction at the /protocol/docker-v2/auth endpoint, so any user with valid credentials and a valid client ID can still obtain a Docker registry authentication token. Exploitation requires network access, valid user credentials, and knowledge of the disabled client ID — meaning the attacker must already be an authenticated user (high privileges required per CVSS) (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows authenticated users to bypass administrative access controls and obtain valid Docker registry authentication tokens for clients that administrators intended to disable. This could result in unauthorized access to container registry resources — including pulling or pushing container images — associated with the disabled client. The confidentiality and integrity impacts are both rated Low, with no availability impact, and the scope is unchanged, limiting the blast radius to the container registry resources tied to the affected client (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify a Keycloak instance with Docker v2 protocol support enabled and locate a Docker registry client that has been administratively disabled (Enabled: OFF) but for which valid user credentials are still known.
2. Authenticate to Keycloak: Using valid user credentials, send an HTTP GET or POST request to the Docker v2 authentication endpoint: GET /realms/{realm}/protocol/docker-v2/auth?service={client_id}&scope={scope} with appropriate Basic Auth or Bearer credentials.
3. Bypass disabled client check: Because Keycloak does not validate the client's "Enabled" status at this endpoint, the server processes the request as if the client were active and issues a valid JWT access token.
4. Use the token: Present the obtained token to the Docker registry associated with the disabled client to perform unauthorized operations such as pulling or pushing container images (Red Hat Bugzilla).

• Logs: Keycloak server logs showing successful token issuance from /protocol/docker-v2/auth for a client ID that is marked as disabled in the admin console; look for INFO or DEBUG entries referencing the disabled client ID alongside successful token grants.
• Network: Unexpected Docker registry authentication requests originating from users or systems that should no longer have access, particularly after a client was administratively disabled.
• Keycloak Admin Events: Absence of expected "Client Disabled" enforcement in audit/event logs — successful Docker v2 token grants for a client ID that was disabled at the time of the request.

Red Hat has released patches addressing this vulnerability in Red Hat build of Keycloak 26.4.10 (RHSA-2026:3947 for packages, RHSA-2026:3948 for OpenShift container images), issued on March 5, 2026. The upstream Keycloak project addressed this in Keycloak 26.5.4. Administrators should upgrade to the patched version as the primary remediation. As a temporary workaround, consider revoking or rotating credentials for users associated with disabled Docker registry clients, or removing the Docker v2 protocol configuration entirely for clients that are no longer needed (Red Hat Advisory RHSA-2026:3947, Keycloak 26.5.4 Release).