Known vulnerabilities in Red Hat build of Keycloak 26.6

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-16105	A flaw was found in the RoleContainerResource component of Keycloak	4.9 Medium	Jul 31, 2026
CVE-2026-18215	Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization…	6.8 Medium	Jul 31, 2026
CVE-2026-18217	Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution	3.4 Low	Jul 31, 2026
CVE-2026-18218	A flaw was found in the TokenManager component of the Keycloak identity management service	4.2 Medium	Jul 31, 2026
CVE-2026-18201	Keycloak provides a way to manage identity providers and organizations through its administrative API	5.5 Medium	Jul 29, 2026
CVE-2026-18207	Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching	6.5 Medium	Jul 29, 2026
CVE-2026-17059	A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the…	6.5 Medium	Jul 24, 2026
CVE-2026-17048	A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients	5.5 Medium	Jul 24, 2026
CVE-2026-16104	A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core…	4.3 Medium	Jul 17, 2026
CVE-2026-16103	Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption	4.3 Medium	Jul 17, 2026
CVE-2026-16106	A flaw was found in the admin REST API of Keycloak, a solution for identity and access management	4.9 Medium	Jul 17, 2026
CVE-2026-16108	A flaw was found in the default-groups REST endpoint and realm representation of Keycloak	4.3 Medium	Jul 17, 2026
CVE-2026-16093	Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them…	5.4 Medium	Jul 17, 2026
CVE-2026-16089	A flaw was found in the keycloak-services component of Red Hat Build of Keycloak	5.4 Medium	Jul 17, 2026
CVE-2026-16072	A flaw was found in the organization management component of Keycloak	4.9 Medium	Jul 17, 2026
CVE-2026-15943	Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change	5.5 Medium	Jul 17, 2026
CVE-2026-15945	A flaw was found in the group search functionality of the Keycloak server's administrative API	4.3 Medium	Jul 16, 2026
CVE-2026-14615	A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative…	4.3 Medium	Jul 3, 2026
CVE-2026-14614	A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP)…	5.4 Medium	Jul 3, 2026
CVE-2026-14613	A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see…	4.3 Medium	Jul 3, 2026
CVE-2026-12388	Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper	6.5 Medium	Jun 30, 2026
CVE-2026-14209	A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass…	4.3 Medium	Jun 30, 2026
CVE-2026-11800	A flaw was found in Keycloak	8.1 High	Jun 25, 2026
CVE-2026-9083	A flaw was found in Keycloak	4.9 Medium	Jun 25, 2026
CVE-2026-9799	A flaw was found in org.keycloak.authorization	4.6 Medium	Jun 25, 2026

Other Red Hat products