Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-18206 A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator u… https://www.cve.org/CVERecord?id=CVE-2026-18206
Post summary
The post notes the discovery of a flaw in Keycloak's keycloak-services component, but provides no further technical, exploit, or mitigation details.
🚨*CVE* CVE-2026-18206 A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator u… https://www.cve.org/CVERecord?id=CVE-2026-18206 ----- Traducción: Se encontró una fa… http://infoflow.cloud`
Post summary
The message announces the discovery of a new vulnerability (CVE-2026-18206) affecting Keycloak’s services component.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |