# CVE-2026-1518: keycloak-parent (Low 2.7)

☕

☕ Maven

Not in CISA KEV

LOW severity

# CVE-2026-1518 — keycloak-parent

LOW 

CVE-2026-1518 is a low-severity (CVSS 2.7) vulnerability in org.keycloak:keycloak-parent. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Keycloak Server-Side Request Forgery (SSRF) vulnerability

Published

Feb 2, 2026

Updated

Feb 3, 2026

Affected

1 pkg

Patched

None yet

Exploits

None indexed

Exploitation data as of Feb 3, 2026 · OSV.dev, FIRST.org (EPSS)

## Real-World Exposure

1 pkg affected

☕`org.keycloak:keycloak-parent`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

## Description

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

## Affected Packages

1 total

Ecosystem

Package

Vulnerable range

Fix

☕Maven

`org.keycloak:keycloak-parent` 

all versions

No fix

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-parent, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Remediation status
    
    The records we use list no patched version of org.keycloak:keycloak-parent for CVE-2026-1518. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
    
3.  ### Mitigate without a patch
    
    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
    

## Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatLow

This LOW impact flaw in Red Hat Build of Keycloak allows a highly privileged attacker to perform blind Server-Side Request Forgery (SSRF). By configuring the CIBA backchannel notification endpoint to an internal URL, an attacker can induce Keycloak to send requests to arbitrary internal services. Exploitation requires…

Workaround published by Red Hat

> To mitigate this issue, restrict administrative access to Keycloak instances. Ensure that only trusted and authorized personnel have the necessary privileges to configure client settings, including the backchannel\_client\_notification\_endpoint. This limits the ability of an attacker to manipulate the endpoint for SSRF attacks.

Source: [Red Hat security advisory for CVE-2026-1518](https://access.redhat.com/security/cve/cve-2026-1518) (CC BY 4.0)

## Frequently Asked Questions

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

O3 Security · Impact-Aware SCA

### Is CVE-2026-1518 in your dependencies?

Find it across Maven, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)