Red Hat Security AdvisoryRHSA-2026:56524
Red Hat build of Keycloak 26.6.6 Images Security Update
Released 2026-08-18 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Fixes 5 records
Priority MEDIUM 55
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.04682 · Published 2026-08-18 · Partial fix · 26.4.15-1, 26.4-23 +5 CWE-640
Priority LOW 34
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.0043 · Published 2026-08-18 · Fixed in 26.6.6-1, 26.6-12 CWE-341
Priority LOW 28
A flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00219 · Published 2026-05-28 · Partial fix · 26.6.6-1, 26.6-12 +1 CWE-367
Priority LOW 25
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00424 · Published 2026-07-24 · Fixed in 26.6.6-1, 26.6-12 CWE-200
Priority LOW 23
A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00375 · Published 2026-07-03 · Fixed in 26.6.6-1, 26.6-12 CWE-1220
THREATIST.IORead the docs