Red Hat Security AdvisoryRHSA-2026:50847
Red Hat build of Keycloak 26.4.14 Images Security Update
Released 2026-08-05 · Red Hat rating Important · View on Red Hat →
Fixes 17 records
Priority HIGH 70
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01066 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 42
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-346
Priority MEDIUM 41
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00321 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority MEDIUM 41
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00652 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-843
Priority MEDIUM 40
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01226 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00549 · Published 2026-07-30 · Partial fix CWE-770
Priority LOW 38
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 38
A flaw was found in Keycloak's Authorization Services.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
TI-2026-08588 CVE-2026-9800 · GHSA-79qw-g39g-mfxc · GHSA-f5p5-6xmx-p252 Priority LOW 38
A flaw was found in Keycloak Policy Enforcer.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00651 · Published 2026-06-25 · Partial fix · 26.4.13-1, 26.4-19 +7 CWE-1025
Priority LOW 32
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority LOW 31
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00486 · Published 2026-06-30 · Fixed in 26.4.14-1, 26.4-22 CWE-266
Priority LOW 24
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-90
Priority LOW 24
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 20
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1220
Priority LOW 20
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00386 · Published 2026-06-30 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00375 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-305
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.2· Network · No auth · User interaction · EPSS 0.00322 · Published 2026-05-27 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1288
THREATIST.IORead the docs