CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol
Attackers can obtain authentication tokens for disabled Docker registry clients, bypassing administrative controls and gaining unintended access to container resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2733?
CVE-2026-2733 is a low-severity authentication bypass vulnerability in Red Hat Build of Keycloak, published on 19 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
Weakness: CWE-285
Which versions are affected by CVE-2026-2733?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions to 26.5.3 | None |
org.keycloak:keycloak-services Maven | All versions to 26.5.3 | None |
How do I fix CVE-2026-2733?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-2733 being exploited?
There is no known exploitation of CVE-2026-2733 in the wild and no public exploit code.
Sources
Also known as GHSA-fjf4-6f34-w64q, MINI-39cm-74x6-qjwj, MINI-m9xr-w9pr-qgmc.