Skip to contentRed Hat Build Of Keycloak 26.4.14 vulnerabilities
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationCVE-2026-15572Fix available8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restrictionCVE-2026-16442Fix available7.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +5 more +7 moreKeycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundaryCVE-2026-16071Fix available5.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 moreKeycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappersCVE-2026-16102Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 moreKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherCVE-2026-15573Fix available8.1 High
- redhat build of keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: saml broker metadata import disables response signature validationCVE-2026-16443Fix available7.4 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filterCVE-2026-14615Fix available4.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresourceCVE-2026-14614Fix available5.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6.5 +1 more +3 moreKeycloak: keycloak: privilege escalation through hardcoded role mapper injectionCVE-2026-46296.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +3 more +5 moreKeycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictionsCVE-2026-142094.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.4.14 +8 more +10 moreKeycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonCVE-2026-9800Fix available8.1 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: brute-force protection bypass in ciba flowCVE-2026-97984.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security policy bypass in jwe-encrypted request object processingCVE-2026-97935.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604CVE-2026-96894.2 Medium