A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated. This can lead to a blind server-side request forgery (SSRF) attack.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-105301 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests.
CVE-2026-105301
✕ Withdrawn — historical dataMEDIUMPre-NVD 4.0
4.0CVSS
- CVSS v3
- 4.0
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
October 5, 2026
Last Modified
October 6, 2026
References (2)
- secalert@redhathttps://access.redhat.com/security/cve/CVE-2026-105301
- secalert@redhathttps://bugzilla.redhat.com/show_bug.cgi?id=2545797
Frequently asked(4)
What is CVE-2026-105301?
CVE-2026-105301 is a rejected CVE ID: its record was withdrawn on October 21, 2026 and no longer describes a vulnerability. Reason given: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests.
When was the CVE record for CVE-2026-105301 published?
The CVE record for CVE-2026-105301 was published on October 5, 2026. EchelonGraph's copy of the record carries a last-modified date of October 6, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-105301?
CVE-2026-105301 has a CVSS base score of 4.0 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-105301?
There is nothing to remediate under CVE-2026-105301: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.