Red Hat Security AdvisoryRHSA-2026:30050
Red Hat build of Keycloak 26.4.13 Images Security Update
Released 2026-06-25 · Red Hat rating Important · View on Red Hat →
Fixes 22 records
Priority HIGH 70
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00238 · Published 2026-05-06 · Partial fix · 4.5.27, 5.0.12 CWE-295
Priority MEDIUM 40
A flaw was found in Keycloak.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0032 · Published 2026-05-27 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284
TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252 Priority LOW 38
A flaw was found in Keycloak Policy Enforcer.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00651 · Published 2026-06-25 · Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025
Priority LOW 37
A flaw was found in Keycloak.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00312 · Published 2026-05-20 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-639
Priority LOW 36
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.7· Network · High privileges · No interaction · EPSS 0.0049 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +2 CWE-639
TI-2026-08506 CVE-2026-9705 · GHSA-q929-g23j-2rc7 · GHSA-r7rc-c989-86g6 Priority LOW 35
A flaw was found in Keycloak's client registration service.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00464 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-613
TI-2026-07983 CVE-2026-9086 · GHSA-37j9-56gh-j2r7 · GHSA-v3f7-2p4r-mwfw Priority LOW 35
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00781 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-79
Priority LOW 34
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature.
CVSS 3.1HIGH 7.3· Network · High privileges · User interaction · EPSS 0.00354 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-266
Priority LOW 34
A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00268 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-280
Priority LOW 32
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.003 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-613
Priority LOW 30
A flaw was found in Keycloak's ClientRegistrationAuth component.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00417 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-125
Priority LOW 30
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-209
Priority LOW 24
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00258 · Published 2026-04-06 · Fixed in 26.4.13-1, 26.4-19 +4 CWE-346
TI-2026-07980 CVE-2026-9083 · GHSA-7pm9-g8jh-3m74 · GHSA-9jrw-8xf7-xqhq Priority LOW 24
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.0078 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-22
Priority LOW 24
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00281 · Published 2026-05-19 · Fixed in 26.4.13-1, 26.4-19 +2 CWE-303
Priority LOW 24
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00232 · Published 2026-04-30 · Fixed in 26.4.13-1, 26.4-19 +2 CWE-425
Priority LOW 23
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00477 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-1284
TI-2026-08587 CVE-2026-9799 · GHSA-gfv4-4vr2-rr4g · GHSA-w3p3-7cjg-vgfw Priority LOW 21
A flaw was found in org.keycloak.authorization.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00294 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-639
Priority LOW 20
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00392 · Published 2026-05-19 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-603
Priority LOW 19
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00215 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-863
Priority LOW 15
A flaw was found in Keycloak.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00353 · Published 2026-03-26 · Partial fix · 26.4.13-1, 26.4-19 +4 CWE-918
Priority LOW 14
A flaw was found in org.keycloak.services.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00348 · Published 2026-06-05 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-1220
THREATIST.IORead the docs