Red Hat Security Advisory

RHSA-2026:3948

Red Hat build of Keycloak 26.4.10 Images Update

Released 2026-03-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixes 8 records

TI-2026-02223 CVE-2026-2603 · GHSA-x4p7-7chp-64hq

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

HIGH 70

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00451 Published 2026-03-18 Fixed in 26.2.14-1, 26.2-16 +3 CWE-306

TI-2026-02631 CVE-2026-3047 · GHSA-8cr3-vpxx-92cx

Authentication bypass in Red Hat build of Keycloak 26.2

MEDIUM 41

A flaw was found in org.keycloak.broker.saml.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00545 Published 2026-03-05 Fixed in 26.2.14-1, 26.2-16 +2 CWE-305

TI-2026-02598 CVE-2026-3009 · GHSA-m297-3jv9-m927

Incorrect authorization in Red Hat build of Keycloak 26.4

LOW 37

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0038 Published 2026-03-05 Partial fix · 26.4.10-1, 26.4-12 +1 CWE-863

TI-2026-01746 CVE-2026-2092 · GHSA-794g-x443-36f7

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

LOW 34

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00383 Published 2026-03-18 Fixed in 26.2.14-1, 26.2-16 +7 CWE-1287

TI-2026-02198 CVE-2026-2575 · GHSA-xv6h-r36f-3gp5

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

LOW 31

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00663 Published 2026-03-18 Fixed in 26.4.10-1, 26.4-12 +5 CWE-409

TI-2026-00498 CVE-2026-0707 · GHSA-gv94-wp4h-vv8p

Keycloak: keycloak authorization header parsing leading to potential security control bypass

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00403 Published 2026-01-08 Fixed in 26.4.10-1, 26.4-12 CWE-551

TI-2026-02339 CVE-2026-2733 · GHSA-fjf4-6f34-w64q

Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

LOW 18

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00371 Published 2026-02-19 Partial fix · 26.4.10-1, 26.4-12 CWE-285

TI-2026-00917 CVE-2026-1190 · GHSA-63v5-26vq-m4vm

Improper signature verification in Red Hat build of Keycloak 26.4

LOW 15

A flaw was found in Keycloak's SAML brokering functionality.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00415 Published 2026-01-26 Partial fix · 26.4.10-1, 26.4-12 CWE-112