Red Hat Security AdvisoryRHSA-2026:30084
Red Hat build of Keycloak 26.6.4 Images Security Update
Released 2026-06-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Fixes 9 records
Priority HIGH 70
A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00238 · Published 2026-05-06 · Partial fix · 4.5.27, 5.0.12 CWE-295
TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252 Priority LOW 38
A flaw was found in Keycloak Policy Enforcer.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00651 · Published 2026-06-25 · Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025
TI-2026-10185 CVE-2026-11800 · GHSA-gqj5-2xp5-3qmp · GHSA-j97h-3f8r-mrjr Priority LOW 37
A flaw was found in Keycloak.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.003 · Published 2026-06-25 · Partial fix · 26.6.4-2, 26.6-8 +1 CWE-347
Priority LOW 36
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.7· Network · High privileges · No interaction · EPSS 0.0049 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +2 CWE-639
TI-2026-08506 CVE-2026-9705 · GHSA-q929-g23j-2rc7 · GHSA-r7rc-c989-86g6 Priority LOW 35
A flaw was found in Keycloak's client registration service.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00464 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-613
TI-2026-07983 CVE-2026-9086 · GHSA-37j9-56gh-j2r7 · GHSA-v3f7-2p4r-mwfw Priority LOW 35
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00781 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-79
Priority LOW 34
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature.
CVSS 3.1HIGH 7.3· Network · High privileges · User interaction · EPSS 0.00354 · Published 2026-05-28 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-266
TI-2026-07980 CVE-2026-9083 · GHSA-7pm9-g8jh-3m74 · GHSA-9jrw-8xf7-xqhq Priority LOW 24
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.0078 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-22
TI-2026-08587 CVE-2026-9799 · GHSA-gfv4-4vr2-rr4g · GHSA-w3p3-7cjg-vgfw Priority LOW 21
A flaw was found in org.keycloak.authorization.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00294 · Published 2026-06-25 · Fixed in 26.4.13-1, 26.4-19 +3 CWE-639
THREATIST.IORead the docs