Red Hat Security AdvisoryRHSA-2025:21371
Red Hat build of Keycloak 26.4.4 Images Security Update
Released 2025-11-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Fixes 5 records
Priority LOW 32
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0).
CVSS 3.1MEDIUM 6.8· Adjacent network · No auth · No interaction · EPSS 0.00425 · Published 2025-11-13 · Fixed in 26.4.4, 26.4.4-1 +1 CWE-1327
Priority LOW 28
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.0· Local · Low privileges · User interaction · EPSS 0.00141 · Published 2025-10-28 · Fixed in 26.0.0, 26.2.11-1 +3 CWE-384
Priority LOW 24
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2025-10-23 · Fixed in 26.4.3, 26.2.11-1 +4 CWE-613
Priority LOW 18
A flaw was found in Keycloak.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00411 · Published 2025-10-28 · Fixed in 26.4.4, 26.4.4-1 +1 CWE-427
Priority LOW 15
A flaw was found in Keycloak’s WebAuthn registration component.
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.0023 · Published 2026-02-27 · Fixed in 26.4.4, 26.2.11-1 +3 CWE-347
