Red Hat Security AdvisoryRHSA-2026:68277
Red Hat build of Keycloak 26.6.7 Images Security Update
Released 2026-09-16 · Red Hat rating Important · View on Red Hat →
Fixes 28 records
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 40
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00806 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-400
Priority MEDIUM 40
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00704 · Published 2026-09-16 · Partial fix · 26.4.16-2, 26.4-26 +2 CWE-401
Priority MEDIUM 40
A flaw was found in RESTEasy's SourceProvider.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0085 · Published 2026-08-31 · Partial fix · 6.2.16.Final-redhat-00003, 26.6.7-3 +6 CWE-611
Priority LOW 39
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00847 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-862
Priority LOW 37
React Router is a router for React.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00416 · Published 2026-06-02 · Partial fix · 7.14.2 CWE-502
Priority LOW 37
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant).
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00404 · Published 2026-07-31 · Fixed in 26.6.7-3, 26.6-20 CWE-287
Priority LOW 37
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-07-31 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 35
Keycloak is an open-source identity and access management solution.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00625 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-862
Priority LOW 34
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00548 · Published 2026-08-02 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 31
A flaw was found in the first-broker-login flow of the keycloak-services component.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00686 · Published 2026-09-16 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-287
Priority LOW 29
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0048 · Published 2026-08-02 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 29
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0039 · Published 2026-08-02 · Fixed in 26.6.7-3, 26.6-20 CWE-863
Priority LOW 29
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00409 · Published 2026-07-24 · Fixed in 26.6.7-3, 26.6-20 CWE-639
Priority LOW 29
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0037 · Published 2026-07-17 · Fixed in 26.6.7-3, 26.6-20 CWE-1220
Priority LOW 29
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00455 · Published 2026-07-17 · Fixed in 26.6.7-3, 26.6-20 CWE-212
Priority LOW 26
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00339 · Published 2026-08-25 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 26
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak.
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00295 · Published 2026-07-17 · Fixed in 26.6.7-3, 26.6-20 CWE-472
Priority LOW 25
Keycloak provides a way to manage identity providers and organizations through its administrative API.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00383 · Published 2026-07-29 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 25
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-07-17 · Partial fix · 26.6.7-3, 26.6-20 CWE-807
Priority LOW 24
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00305 · Published 2026-08-02 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 24
A flaw was found in the TokenManager component of the Keycloak identity management service.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00288 · Published 2026-07-31 · Fixed in 26.6.7-3, 26.6-20 CWE-862
Priority LOW 23
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00563 · Published 2026-09-09 · Fixed in 26.4.16-2, 26.4-26 +2 CWE-22
Priority LOW 23
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00423 · Published 2026-07-17 · Fixed in 26.6.7-3, 26.6-20 CWE-1220
Priority LOW 23
A flaw was found in the RoleContainerResource component of Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00423 · Published 2026-07-31 · Fixed in 26.6.7-3, 26.6-20 CWE-639
Priority LOW 23
A flaw was found in the organization management component of Keycloak.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00432 · Published 2026-07-17 · Fixed in 26.6.7-3, 26.6-20 CWE-497
Priority LOW 22
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00409 · Published 2026-07-31 · Fixed in 26.6.7-3, 26.6-20 CWE-1288
Priority LOW 20
A flaw was found in the group search functionality of the Keycloak server's administrative API.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00348 · Published 2026-07-16 · Partial fix · 26.6.7-3, 26.6-20 CWE-639
THREATIST.IORead the docs