This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests.
CVE-2026-105301
keycloak-services: keycloak-services: Blind SSRF via X.509 authenticator fetching attacker-controlled CRL-DP/OCSP URLs
Published Oct 5, 2026
CVSS 3.1 · 4.0 Medium
EPSS n/a
KEV · Not listed
Description
This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests.
Analysis
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required None
Scope Changed
Confidentiality Impact Low
Integrity Impact None
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
History
Oct 21, 2026 5:15 PM
Description updated. Title updated. Affected versions updated. Affected vendors updated. References updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack. | This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests. |
| Title | Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls | keycloak-services: keycloak-services: Blind SSRF via X.509 authenticator fetching attacker-controlled CRL-DP/OCSP URLs |
| CPEs | cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat build Keycloak
Redhat red Hat Single Sign On |
|
| References |
|
|
| Metrics |
ssvc
|
Oct 9, 2026 9:15 AM
First appearance in the feed. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat build Of Keycloak
Redhat single Sign-on |
|
| Vendors & Products |
Redhat build Of Keycloak
Redhat single Sign-on |
Oct 5, 2026 3:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Oct 5, 2026 12:15 PM
Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Oct 5, 2026 6:00 AM
Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack. | |
| Title | Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls | |
| First Time appeared |
Redhat
Redhat build Keycloak Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:/a:redhat:build_keycloak: cpe:/a:redhat:red_hat_single_sign_on:7 |
|
| Vendors & Products |
Redhat
Redhat build Keycloak Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
Weaknesses
-
CWE-918
Server-Side Request Forgery (SSRF)
