CVE-2026-105301

Executive Summary

CVE-2026-105301 is a blind server-side request forgery (SSRF) flaw in the X.509 client-certificate authenticator of Keycloak, an open-source identity and access management solution. The issue arises when the server is configured to check certificate revocation via CRL Distribution Points or OCSP: Keycloak follows attacker-controlled URLs embedded in a client certificate before that certificate has been fully validated, allowing unauthorized outbound requests to internal or external endpoints. The vulnerability is assessed at CVSS 4.0 (moderate), but the Scope:Changed metric means outbound requests can cross trust boundaries into internal networks, making it relevant to any organization exposing Keycloak's X.509 client-certificate authentication path.

Technical Analysis

Keycloak supports mutual TLS authentication where clients present X.509 certificates. When revocation checking is enabled, the server must resolve Certificate Revocation List (CRL) Distribution Points and Online Certificate Status Protocol (OCSP) responder URLs to determine whether a presented certificate has been revoked. These URLs are embedded in the certificate itself, specifically in the CRL Distribution Points extension and the Authority Information Access (AIA) extension, which are attacker-controllable fields for any certificate an attacker can obtain or generate.

The flaw is that Keycloak performs these outbound requests before the certificate is fully validated. A fully validated path would reject the certificate (e.g., on signature, chain, or trust-anchor grounds) prior to any network egress derived from the certificate's own contents. Because the request is made pre-validation, the attacker does not need a trusted, CA-issued certificate or any authentication — they only need to present a certificate whose revocation-checking URLs point at a target of their choosing. This is classified under CWE-918 (Server-Side Request Forgery) and aligns with the classic "SSRF via URL field in a parsed object" pattern documented in CWE-918 research and OWASP guidance.

Key properties of this issue:

• Blind SSRF: The attacker does not receive the response body. Impact is derived from the request itself — its destination, timing, and any observable side effects — rather than from reading returned data.
• Attacker-controlled destination: The target host is taken from certificate extensions (CRL Distribution Points / OCSP URLs) rather than from any server-configured allowlist.
• Pre-validation trigger: The outbound request occurs before full certificate validation, so it is reachable without a valid trusted credential.
• Scope:Changed: The vulnerable component (Keycloak) can cause requests to affect resources beyond its security scope (internal services, cloud metadata endpoints, external hosts).

The exact parsing code path — e.g., the specific class or method that initiates the revocation fetch — is not identified in the NVD description and is therefore not asserted here. Insufficient technical detail is available to name internal functions or configuration parameters beyond "CRL Distribution Points" and "OCSP," which are standard X.509 concepts referenced in the description.

Exploitation Scenarios

No public PoC is available for this CVE; the attack chain below is inferred from the vulnerability class as described in the NVD text.

1. Reconnaissance / Target Identification. The attacker identifies a Keycloak deployment that exposes X.509 client-certificate authentication (mutual TLS) and is configured to perform revocation checking via CRL Distribution Points or OCSP. This configuration is common in enterprise and government PKI environments that mandate revocation checking. A Shodan search for exposed Keycloak instances (e.g., http.title:"Keycloak") narrows the candidate set.

2. Triggering the Flaw. The attacker crafts or obtains an X.509 client certificate and embeds revocation-check URLs pointing to an attacker-chosen destination — for example, an internal-only host, a cloud instance-metadata address, or an external listener under the attacker's control. The certificate is presented to Keycloak's X.509 client-certificate authenticator. Because the server fetches the CRL/OCSP location before fully validating the certificate, the specially crafted URL is dereferenced.

3. Execution Method (vulnerability-class level). The payload is the destination URL itself. When Keycloak resolves the CRL Distribution Point or OCSP responder from the client certificate, it issues the outbound request to the attacker-specified endpoint. No authentication is required because the request is made prior to full validation (PR:N). Complexity is rated High (AC:H), reflecting the need for the specific revocation-checking configuration and the crafted certificate. The SSRF is blind: the attacker observes request timing, connection state, or side-channel effects rather than the response body.

4. Post-Exploitation Impact. Under the blind-SSRF model, the attacker can (a) probe and fingerprint internal network services and ports reachable from the Keycloak host, (b) reach internal-only HTTP endpoints or cloud metadata services that trust requests originating from the server, and (c) induce outbound requests to external infrastructure for use as an egress/exfiltration beacon or for request forgery against third parties. The CVSS vector limits confidentiality to Low (C:L) with no integrity or availability impact, consistent with blind information disclosure and reachability probing rather than direct data exfiltration.

Impact Assessment

The CVSS 3.1 base score is 4.0 (Moderate) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N:

• AV:N (Network) — The X.509 authenticator is reachable over the network; no local access is required.
• AC:H (High) — Exploitation depends on the target being configured for CRL/OCSP revocation checking and on the attacker supplying a crafted certificate with a suitable destination URL.
• PR:N (None) — No authentication is needed, since the fetch occurs before validation.
• UI:N (None) — No user interaction required.
• S:C (Changed) — The vulnerable component causes requests affecting resources outside its security scope (internal services, external hosts), which elevates the assessment relative to an unchanged-scope SSRF.
• C:L (Low) — Limited confidentiality impact consistent with blind response/behavior inference.
• I:N / A:N — No integrity or availability impact identified in the vector.

Business impact: Organizations using Keycloak for identity and access management in a mutual-TLS PKI environment are the primary exposure group. Because Keycloak is frequently positioned as a central authentication hub — often in DMZ or edge networks with reachability to internal directories, databases, and cloud control planes — a successful blind SSRF can serve as an initial foothold for internal reconnaissance. The blast radius is bounded by what the Keycloak host can reach: internal-only web services, cloud instance metadata endpoints, and third-party HTTP services. No public exploit, no Nuclei template, and no CISA KEV listing currently exist, and EPSS has not yet scored the CVE, so the immediate likelihood of exploitation in the wild is assessed as low-to-moderate, rising for exposed, revocation-checking deployments.

Detection Guidance

Sigma Rule

title: Keycloak X.509 Client-Certificate Authenticator Blind SSRF via CRL/OCSP URL
id: 9f2c1a4e-7b3d-4c8a-9e21-0d5f6a7b8c90
status: experimental
description: Detects outbound HTTP/TLS connections from a Keycloak host to destinations derived from client-certificate CRL Distribution Points or OCSP URLs prior to successful X.509 authentication.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105301
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection_process:
    process.name|contains:
      - 'java'
  selection_egress:
    destination.url|contains:
      - '/crl'
      - 'ocsp'
      - '.crl'
  selection_internal:
    destination.ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
      - '127.0.0.0/8'
  condition: selection_process and selection_egress and selection_internal
falsepositives:
  - Legitimate PKI revocation infrastructure hosted on internal networks
  - Authorized CRL/OCSP mirror endpoints
level: medium

YARA Rule

rule CVE_2026_105301_Keycloak_X509_SSRF_Cert
{
    meta:
        description = "Identifies X.509 certificates containing CRL Distribution Point or OCSP AIA URLs that reference non-public or unusual hosts, as used to trigger blind SSRF in Keycloak's X.509 authenticator (CVE-2026-105301)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105301"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $crl_ext  = "CRL Distribution Points" ascii nocase
        $ocsp     = "OCSP" ascii nocase
        $aia      = "Authority Information Access" ascii nocase
        $http     = "http://" ascii nocase
        $priv10   = "http://10." ascii nocase
        $priv192  = "http://192.168." ascii nocase
        $priv172  = "http://172." ascii nocase
        $meta     = "169.254.169.254" ascii
        $local    = "http://127.0.0.1" ascii

    condition:
        (uint32(0) == 0x03013830 or uint16(0) == 0x3082) and
        ($crl_ext or $ocsp or $aia) and
        3 of ($http, $priv10, $priv192, $priv172, $meta, $local)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105301 Keycloak X.509 Authenticator Blind SSRF via CRL/OCSP URL"; flow:to_server; http.uri; content:"crl"; nocase; http.host; pcre:"/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254|127\.0\.0\.1)/"; classtype:attempted-recon; reference:cve,2026-105301; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105301; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026105301; rev:1;)

Elastic Detection

sequence by destination.ip with maxspan=5s
  [ network where process.name : "java" and destination.port in (80, 443) and
      url.full : ("*crl*" or "*ocsp*") ]
  [ network where process.name : "java" and
      cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.0.0/16", "127.0.0.0/8") ]

Splunk SPL Query

index=proxy OR index=network
| eval dest_cidr=case(
    cidrmatch("10.0.0.0/8", dest_ip), "internal-10",
    cidrmatch("172.16.0.0/12", dest_ip), "internal-172",
    cidrmatch("192.168.0.0/16", dest_ip), "internal-192",
    cidrmatch("169.254.0.0/16", dest_ip), "link-local",
    cidrmatch("127.0.0.0/8", dest_ip), "loopback",
    true(), "external")
| where (like(lower(url), "%crl%") OR like(lower(url), "%ocsp%"))
| where dest_cidr!="external"
| stats count min(_time) as first_seen max(_time) as last_seen
    values(dest_ip) as destinations values(url) as request_urls
    by src_ip, user_agent, dest_cidr
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,keycloak,ssrf,">
  <rule id="105301" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">java</field>
    <field name="destination.port">^443$|^80$</field>
    <field name="url.full" type="pcre2">(?i)(crl|ocsp)</field>
    <field name="destination.ip" type="pcre2">^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|127\.)</field>
    <description>CVE-2026-105301: Keycloak X.509 authenticator outbound request to internal target derived from CRL/OCSP URL</description>
    <mitre>
      <id>T1190</id>
      <id>T1071.001</id>
    </mitre>
    <group>ssrf,pki,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source; no vendor fix, workaround, or affected version range has been published. Treat the deployment as unpatched.

1. Immediate mitigations

   • Disable CRL Distribution Point and OCSP revocation checking on the X.509 client-certificate authentication path until a fix is available, if revocation checking is not operationally mandatory. This removes the pre-validation fetch that triggers the SSRF.
   • If revocation checking is mandatory, restrict egress from the Keycloak host using a network policy or firewall allowlist: permit outbound traffic only to known, internal revocation endpoints and block access to link-local metadata addresses (169.254.0.0/16), loopback, and unapproved internal ranges.
   • Isolate the Keycloak host in a segmented network zone with no route to sensitive internal control planes or cloud instance-metadata services.
   • Monitor and log outbound connections initiated during TLS handshakes / authentication for anomalies.

2. Patch / upgrade steps

   • No vendor patch is currently available (patch confidence 0/4). Monitor the Keycloak security advisories page and the NVD entry for CVE-2026-105301 for an updated release.
   • When a fix is published, upgrade to the patched Keycloak version, re-enable revocation checking if it was disabled, and verify that outbound requests derived from certificate extensions are gated behind full certificate validation.

3. Long-term hardening

   • Enforce an egress allowlist for all identity-provider infrastructure, treating certificate-provided URLs as untrusted input.
   • Add SSRF resistance tests to CI for code paths that fetch remote resources from parsed/attacker-influenced objects.
   • Reduce the network reachability of IAM components so that any residual SSRF cannot reach control planes or metadata services.
   • Track CVE-2026-105301 for EPSS scoring, vendor advisory, and any KEV addition.

References

• NVD — CVE-2026-105301: https://nvd.nist.gov/vuln/detail/CVE-2026-105301
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• OWASP — Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• Keycloak Security Advisories: https://www.keycloak.org/security
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No public proof-of-concept, Nuclei template, or exploit code is known for this CVE. No CISA KEV entry exists, and no EPSS score has been assigned as of this report. No threat-actor campaign or exploit-in-the-wild evidence is presently associated with CVE-2026-105301.