Red Hat Security AdvisoryRHSA-2026:50846
Red Hat build of Keycloak 26.4.14 Security Update
Released 2026-08-05 · Red Hat rating Important · View on Red Hat →
Fixes 26 records
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-20 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority HIGH 70
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01066 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 45
Netty is a network application framework for development of protocol servers and clients.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority MEDIUM 45
Netty is a network application framework for development of protocol servers and clients.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority MEDIUM 42
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-346
Priority MEDIUM 41
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00321 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority MEDIUM 41
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00652 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-843
Priority MEDIUM 40
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-20 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority MEDIUM 40
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01226 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00549 · Published 2026-07-30 · Partial fix CWE-770
Priority LOW 38
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 38
A flaw was found in Keycloak's Authorization Services.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252 Priority LOW 38
A flaw was found in Keycloak Policy Enforcer.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00651 · Published 2026-06-25 · Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025
Priority LOW 37
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00609 · Published 2026-07-29 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-770
Priority LOW 35
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches…
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00197 · Published 2026-07-14 · Partial fix CWE-346
Priority LOW 35
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00197 · Published 2026-07-14 · Partial fix CWE-200
Priority LOW 32
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority LOW 31
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00486 · Published 2026-06-30 · Fixed in 26.4.14-1, 26.4-22 CWE-266
Priority LOW 29
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00408 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-284
Priority LOW 24
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-90
Priority LOW 24
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 20
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1220
Priority LOW 20
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00386 · Published 2026-06-30 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00375 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-305
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.2· Network · No auth · User interaction · EPSS 0.00322 · Published 2026-05-27 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1288