Bug 2440895 (CVE-2026-2733)

Summary: CVE-2026-2733 org.keycloak/keycloak-services: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aschwart, asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, darran.lofthouse, dosoudil, fjuma, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, smaestri, ssilvert, sthorger, tom.jenkinson, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-19 07:23:01 UTC 
Improper Authorization vulnerability in the Docker v2 authentication endpoint (/protocol/docker-v2/auth) of Keycloak. The issue occurs because the server fails to validate the client’s “Enabled” status before minting an access token. Even after the client is administratively disabled, the endpoint continues to issue valid authentication tokens when provided with valid user credentials and client ID. This allows authenticated users to bypass intended administrative restrictions, potentially enabling unauthorized access to container registry resources associated with the disabled client.