Red Hat Security Advisory

RHSA-2026:6478

Red Hat build of Keycloak 26.4.11 Images Update

Released 2026-04-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixes 15 records

TI-2026-04036 CVE-2026-4634 · GHSA-h4wv-g838-66g3

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

MEDIUM 40

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00638 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +7 CWE-1050

TI-2026-04038 CVE-2026-4636 · GHSA-f2hx-5fx3-hmcv

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

LOW 38

A flaw was found in Keycloak.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +3 CWE-551

TI-2026-03727 CVE-2026-4282 · GHSA-hj93-h7pg-fh6v

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

LOW 35

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00432 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +3 CWE-653

TI-2026-03352 CVE-2026-3872 · GHSA-cjm2-j6cm-6p6m

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

LOW 34

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00448 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +3 CWE-601

TI-2026-02698 CVE-2026-3121 · GHSA-7xf9-4jfc-wgm4

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

LOW 34

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00479 Published 2026-03-26 Partial fix · 26.4.11-1, 26.4-14 +1 CWE-266

TI-2026-00907 CVE-2026-1180 · GHSA-7vw6-5q2f-7w5r

Server-side request forgery in Red Hat build of Keycloak 26.4

LOW 32

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00406 Published 2026-01-20 Partial fix · 26.4.11-1, 26.4-14 CWE-918

TI-2025-13490 CVE-2025-14777 · GHSA-4cj5-g32w-86fv

Keycloak: keycloak idor in realm client creating/deleting

LOW 27

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00345 Published 2025-12-16 Fixed in 26.4.11-1, 26.4-14 CWE-289

TI-2026-03764 CVE-2026-4325 · GHSA-rx66-hj7g-28h7

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00255 Published 2026-04-02 Fixed in 26.2.15-1, 26.2-18 +3 CWE-653

TI-2026-02755 CVE-2026-3190 · GHSA-q35r-vvhv-vx5h

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

LOW 20

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00325 Published 2026-03-26 Fixed in 26.4.11-1, 26.4-14 +1 CWE-280

TI-2026-02960 CVE-2026-3429 · GHSA-8g9r-9wjw-37j4

Improper access control in Red Hat build of Keycloak 26.4

LOW 19

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00277 Published 2026-03-11 Fixed in 26.4.11-1, 26.4-14 CWE-284

TI-2026-02002 CVE-2026-2366 · GHSA-r8jr-wg88-fq5c

Keycloak: keycloak: information disclosure via authorization bypass in admin api

LOW 15

A flaw was found in Keycloak.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00296 Published 2026-03-12 Fixed in 26.4.11-1, 26.4-14 CWE-639

TI-2026-00774 CVE-2026-1035 · GHSA-m2w5-7xhv-w6fh

Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition

LOW 15

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00303 Published 2026-01-21 Fixed in 26.4.11-1, 26.4-14 CWE-367

TI-2026-03379 CVE-2026-3911 · GHSA-xh32-c9wx-phrp

Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of…

LOW 14

A flaw was found in Keycloak.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00369 Published 2026-03-11 Fixed in 26.4.11-1, 26.4-14 CWE-359

TI-2025-12869 CVE-2025-14083 · GHSA-594w-2fwp-jwrc

Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure

LOW 14

A flaw was found in the Keycloak Admin REST API.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00351 Published 2026-01-21 Fixed in 26.4.11-1, 26.4-14 CWE-284

TI-2025-12868 CVE-2025-14082 · GHSA-6q37-7866-h27j

Improper access control in Red Hat build of Keycloak 26.4

LOW 14

A flaw was found in Keycloak Admin REST (Representational State Transfer) API.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00351 Published 2025-12-10 Fixed in 26.4.11-1, 26.4-14 +1 CWE-284