Description
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
Metrics
CVSS 3.1 3.8/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — |
| Red Hat | Red Hat build of Keycloak 26.4.10 | — |
| Red Hat | Red Hat Build of Keycloak | — |
| Red Hat | Red Hat Build of Keycloak | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
References
Timeline
- Published
- Feb 19, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Deferred