Red Hat Security AdvisoryRHSA-2026:50849
Red Hat build of Keycloak 26.6.5 Images Security Update
Released 2026-08-05 · Red Hat rating Important · View on Red Hat →
Fixes 19 records
Priority HIGH 70
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01066 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 42
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-346
Priority MEDIUM 41
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00321 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority MEDIUM 41
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00652 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-843
Priority MEDIUM 40
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01226 · Published 2026-06-23 · Partial fix · 2.18.8, 2.21.4 +1 CWE-184
Priority MEDIUM 40
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00792 · Published 2026-06-09 · Partial fix · 1.16.5.1, 1.15.11.1 +7 CWE-400
Priority MEDIUM 40
In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00631 · Published 2026-06-09 · Partial fix · 1.16.5.1, 1.15.11.1 +2 CWE-400
Priority MEDIUM 40
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00549 · Published 2026-07-30 · Partial fix CWE-770
Priority LOW 38
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 38
A flaw was found in Keycloak's Authorization Services.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 32
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-347
Priority LOW 30
A flaw was found in the user-event metrics recording of Keycloak.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00552 · Published 2026-08-05 · Fixed in 26.6.5-1, 26.6-11 CWE-770
Priority LOW 24
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-08-05 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-90
Priority LOW 24
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00315 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 22
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00301 · Published 2026-06-11 · Fixed in 26.6.5-1, 26.6-11 +1 CWE-425
Priority LOW 20
A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-07-03 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1220
Priority LOW 20
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00386 · Published 2026-06-30 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-639
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00375 · Published 2026-05-28 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-305
Priority LOW 20
A flaw was found in Keycloak, an open-source identity and access management solution.
CVSS 3.1MEDIUM 4.2· Network · No auth · User interaction · EPSS 0.00322 · Published 2026-05-27 · Fixed in 26.4.14-1, 26.4-22 +2 CWE-1288
THREATIST.IORead the docs