Low severity3.8NVD Advisory· Published Feb 19, 2026· Updated Apr 15, 2026
CVE-2026-2733
CVE-2026-2733
Description
A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | <= 26.5.3 | — |
Affected products
3- osv-coords3 versionspkg:apk/chainguard/keycloak-fips-26.5pkg:apk/chainguard/keycloak-fips-26.5-iamguarded-fipspkg:maven/org.keycloak/keycloak-services
< 26.5.4-r0+ 2 more
- (no CPE)range: < 26.5.4-r0
- (no CPE)range: < 26.5.4-r0
- (no CPE)range: <= 26.5.3
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-fjf4-6f34-w64qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-2733ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:3947nvdWEB
- access.redhat.com/errata/RHSA-2026:3948nvdWEB
- access.redhat.com/security/cve/CVE-2026-2733nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/keycloak/keycloak/commit/743ac24081b2c6da36aac3775147ec5b80c2861eghsaWEB
- github.com/keycloak/keycloak/issues/46462ghsaWEB
News mentions
0No linked articles in our index yet.