Cyber Resilience

CVE-2026-2733

Low

Published: 19 February 2026

Published
19 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0033 24.7th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-2733 is a low-severity Improper Authorization (CWE-285) vulnerability. Its CVSS base score is 3.8 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud Accounts (T1078.004); ranked at the 24.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not…

more

fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.

CWE(s)
CWE-285

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.004 Cloud Accounts Stealth
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1550.001 Application Access Token Lateral Movement
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.
attack.mitre.org →
Why these techniques?

Bypass of disabled client setting allows continued token issuance and use of valid accounts for registry access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-285

Documented procedures facilitate correct implementation and ongoing management of authorization decisions.

AC-13 Supervision and Review — Access Control
addresses: CWE-285

Periodic reviews identify and correct flaws in authorization decisions or enforcement.

AC-14 Permitted Actions Without Identification or Authentication
addresses: CWE-285

The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.

AC-16 Security and Privacy Attributes
addresses: CWE-285

Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.

AC-17 Remote Access
addresses: CWE-285

Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.

AC-18 Wireless Access
addresses: CWE-285

The control explicitly requires authorization of each wireless access type prior to permitting connections.

AC-19 Access Control for Mobile Devices
addresses: CWE-285

Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.

AC-2 Account Management
addresses: CWE-285

Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.

References