Red Hat Security AdvisoryRHSA-2026:68276
Red Hat build of Keycloak 26.4.16 Images Security Update
Released 2026-09-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Fixes 7 records
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 40
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00806 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-400
Priority MEDIUM 40
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00704 · Published 2026-09-16 · Partial fix · 26.4.16-2, 26.4-26 +2 CWE-401
Priority LOW 39
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00847 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-862
Priority LOW 35
Keycloak is an open-source identity and access management solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00625 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-862
Priority LOW 31
A flaw was found in the first-broker-login flow of the keycloak-services component.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00686 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-287
Priority LOW 23
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00563 · Published 2026-09-09 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-22
THREATIST.IORead the docs