Skip to contentRed Hat Build Of Keycloak 26 vulnerabilities
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 moreKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsCVE-2026-16104Fix available4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemptionCVE-2026-161034.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child rolesCVE-2026-16106Fix available4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2CVE-2026-16108Fix available4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 moreKeycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headersCVE-2026-16093Fix available5.4 Medium
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 moreKeycloak-services: keycloak-services: authorization codes can be retargeted to another client sessionCVE-2026-16089Fix available5.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creationCVE-2026-16072Fix available4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url changeCVE-2026-159435.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 moreKeycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2CVE-2026-15945Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filterCVE-2026-14615Fix available4.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresourceCVE-2026-14614Fix available5.4 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permissionCVE-2026-14613Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6.5 +1 more +3 moreKeycloak: keycloak: privilege escalation through hardcoded role mapper injectionCVE-2026-46296.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, redhat build of keycloak +2 moreKeycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapperCVE-2026-123886.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +3 more +5 moreKeycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictionsCVE-2026-142094.3 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.4 +3 more +5 moreOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionCVE-2026-11800Public exploitFix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure through arbitrary filesystem path probingCVE-2026-9083Fix available4.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized access to resources via uma permission ticket bypassCVE-2026-9799Fix available4.6 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenCVE-2026-9705Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassCVE-2026-9086Public exploitFix available7.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: group-admin escalation to realm-adminCVE-2026-9099Fix available7.7 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.4.14 +8 more +10 moreKeycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonCVE-2026-9800Fix available8.1 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.5, jboss enterprise application platform expansion pack +1 more +3 moreKeycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakCVE-2026-11986Fix available4.9 Medium
- spring micrometer, red hat amq broker 7.13.6, amq broker 7.14.1 +19 more +21 moreMicrometer HTTP server instrumentations DoS vulnerabilityCVE-2026-40984Fix available7.5 High
- spring micrometer, red hat amq broker 7.14.1, amq clients +18 more +20 moreMicrometer gRPC server instrumentation DoS vulnerabilityCVE-2026-40983Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +1 more +3 moreKeycloak: keycloak: information disclosure due to user profile permission bypassCVE-2026-9088Fix available2.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed authorization headerCVE-2026-9803Fix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartCVE-2026-9802Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: denial of service via malformed ldap password policy responseCVE-2026-9801Fix available4.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: brute-force protection bypass in ciba flowCVE-2026-97984.3 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +2 moreKeycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityCVE-2026-9796Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation via improper scope mapping enforcementCVE-2026-9795Fix available7.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure via saml ecp endpointCVE-2026-9794Public exploitFix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionCVE-2026-9792Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security policy bypass in jwe-encrypted request object processingCVE-2026-97935.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak-rhel9: organization data leak after feature disabled in keycloakCVE-2026-9791Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation due to oversized subject_token jwtCVE-2026-9704Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604CVE-2026-96894.2 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginCVE-2026-9087Fix available6.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataCVE-2026-7571Fix available7.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverCVE-2026-7507Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakCVE-2026-7504Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayCVE-2026-37982Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassCVE-2026-37979Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiCVE-2026-37978Fix available4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml inputCVE-2026-7307Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointCVE-2026-37981Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceCVE-2026-4630Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesCVE-2026-89225.4 Medium
- Show moreLoading…