Bug 2545797 (CVE-2026-105301)

Summary: CVE-2026-105301 keycloak-services: keycloak-services: Blind SSRF via X.509 authenticator fetching attacker-controlled CRL-DP/OCSP URLs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-05 05:27:18 UTC 
A Blind Server-Side Request Forgery (SSRF) vulnerability was discovered in Keycloak within the org.keycloak.services.x509 component. When the X.509 client-certificate authenticator is enabled with CRL Distribution Point (CRLDP) or OCSP revocation checking, Keycloak attempts to fetch the CRL and OCSP responder URLs embedded in the presented client certificate before performing trust revalidation.
An unauthenticated attacker can exploit this by presenting a crafted certificate containing attacker-controlled URLs in the CRL-DP or OCSP Authority Information Access (AIA) extensions. This induces the Keycloak server to initiate outbound HTTP GET or POST requests to arbitrary internal or external endpoints. A secondary exploitation vector exists when a proxy-header cert-lookup provider is configured with proxy-trusted-addresses unset, allowing the attack to be performed via plain HTTP headers without a valid TLS connection. Successful exploitation allows an attacker to probe internal network resources or interact with internal services that are otherwise unreachable from the outside.