Known vulnerabilities in Red Hat Build of Keycloak

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-9689	A flaw was found in Keycloak, an open-source identity and access management solution	4.2 Medium	May 27, 2026
CVE-2026-9087	A flaw was found in Keycloak	6.4 Medium	May 20, 2026
CVE-2026-7571	A flaw was found in Keycloak	7.1 High	May 19, 2026
CVE-2026-7507	A session fixation vulnerability was found in Keycloak's login-actions endpoints	7.5 High	May 19, 2026
CVE-2026-7504	A flaw was found in Keycloak's URL validation logic during redirect operations	8.1 High	May 19, 2026
CVE-2026-37982	A flaw was found in Keycloak	6.8 Medium	May 19, 2026
CVE-2026-37979	A flaw was found in Keycloak	6.5 Medium	May 19, 2026
CVE-2026-37978	A flaw was found in Keycloak	4.9 Medium	May 19, 2026
CVE-2026-7307	A flaw was found in Keycloak	7.5 High	May 19, 2026
CVE-2026-37981	A flaw was found in Keycloak	4.3 Medium	May 19, 2026
CVE-2026-4630	A flaw was found in Keycloak	6.8 Medium	May 19, 2026
CVE-2026-8922	A flaw was found in Keycloak	5.4 Medium	May 19, 2026
CVE-2026-8830	A flaw was found in Keycloak	4.3 Medium	May 19, 2026
CVE-2026-45736	ws is an open source WebSocket client and server for Node.js	4.4 Medium	May 15, 2026
CVE-2026-42587	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42584	Netty is an asynchronous, event-driven network application framework	7.3 High	May 13, 2026
CVE-2026-42579	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42578	Netty is an asynchronous, event-driven network application framework	2.9 Low	May 13, 2026
CVE-2026-42581	Netty is an asynchronous, event-driven network application framework	5.8 Medium	May 13, 2026
CVE-2026-39852	Quarkus is a Java framework for building cloud-native applications	8.8 High	May 5, 2026
CVE-2026-7500	When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled	5.4 Medium	Apr 30, 2026
CVE-2026-5598	Covert timing channel vulnerability in Legion of the Bouncy Castle Inc	8.9 High	Apr 15, 2026
CVE-2025-14813	: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	9.3 Critical	Apr 15, 2026
CVE-2026-37980	A flaw was found in Keycloak, specifically in the organization selection login page	6.9 Medium	Apr 14, 2026
CVE-2026-28291	simple-git enables running native Git commands from JavaScript	8.1 High	Apr 13, 2026

Other Red Hat products