{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105301", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-10-05T05:26:43.422Z", "datePublished": "2026-10-05T05:35:52.421Z", "dateUpdated": "2026-10-21T14:20:32.778Z", "dateRejected": "2026-10-21T14:20:32.778Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-21T14:20:32.778Z"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105301", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-10-05T05:26:43.422Z", "datePublished": "2026-10-05T05:35:52.421Z", "dateUpdated": "2026-10-21T14:20:32.778Z", "dateRejected": "2026-10-21T14:20:32.778Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-21T14:20:32.778Z"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests."}], "id": "CVE-2026-105301", "lastModified": "2026-10-21T15:17:14.433", "metrics": {}, "published": "2026-10-05T06:16:58.207", "references": [], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Rejected"}

{"acknowledgement": "Red Hat would like to thank Ahmed (ahmedx90T) for reporting this issue.", "bugzilla": {"description": "keycloak-services: keycloak-services: Blind SSRF via X.509 authenticator fetching attacker-controlled CRL-DP/OCSP URLs", "id": "2545797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545797"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-105301", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "keycloak-services", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "keycloak-services", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-02T12:19:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105301\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105301"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires specific configurations such as the X.509 authenticator being enabled with CRLDP or OCSP checking. Successful exploitation allows an attacker to induce the server to make unauthorized outbound HTTP requests (Blind SSRF) to internal or external endpoints. The vulnerability's root cause is the fetching of revocation URLs from untrusted client certificates before the certificate's trust chain has been validated.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Build of Keycloak", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_keycloak", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Single Sign-On 7", "source": "cna", "vendor": "Red Hat"}, "product": "single_sign-on", "vendor": "redhat"}], "created": "2026-10-05T08:00:13.003975+00:00", "updated": "2026-10-09T08:45:32.974903+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_keycloak", "redhat$PRODUCT$single_sign-on"]}