Red HatCVE-2026-18206
Red Hat keycloak-services: improper input validation
Low3.7CVE-2026-18206 · Published Jul 31, 2026 · updated Aug 7, 2026
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet | |
| Red Hat Data Grid 8 Product | all versions | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack Product | all versions | No fix yet |
| Red Hat Single Sign-On 7 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-20
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 31 | Red Hat Ansible Automation Platform 2: improper certificate validation | High8.2 | No fix yet |
| Jul 31 | Red Hat gnome-remote-desktop as shipped: resource exhaustion | High7.5 | No fix yet |
| Jul 31 | A flaw was found in 389 Directory Server | High7.5 | No fix yet |
| Jul 31 | Red Hat: buffer overflow | High7.5 | No fix yet |
| Jul 31 | Red Hat Advanced Cluster Security 4: insufficient authenticity check | High8.5 | No fix yet |
| Jul 31 | Red Hat SAML protocol implementation of Keycloak: improper input validation | Low3.4 | No fix yet |