Red Hat Security Advisory: Red Hat build of Keycloak 26.2.16 Images Security Update

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products10

• Red Hat build of Keycloak 26.2
• rhbk/keycloak-operator-bundle@sha256:43a89aece29c0a33128e5a7be4ef26d96956fa125df89e22b183c40e50bb8a1d_amd64 as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9-operator@sha256:13d8216c9f47a6f73ea6ea5c9ae7b8b38a89c3822e48eeed7271e50970132175_ppc64le as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9-operator@sha256:4d2cc26a505eda68f7270c8e8a02d794588f9c7ceec98b763d83e3875f957132_amd64 as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9-operator@sha256:88672078ac0b5a0da5b72c11751fa7b0c1c57679ec0f68cb1fe9ba76932397b5_arm64 as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9-operator@sha256:fa9cebe14d003ae002137462fc5833e5634fd040d8f25a66230da9a753891914_s390x as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9@sha256:01a56463ad6790cf448e66f59a81c229db4159f42e563a13d19de051ec85ca86_s390x as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9@sha256:58e692074e695bee04981aff9641db8070ba1a49ee6134fcc008046cd84da21d_ppc64le as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9@sha256:7861ca2441bed95aab1ad43f9159d5c60b522fe3f43833f1847bd1d3ddef94d3_amd64 as a component of Red Hat build of Keycloak 26.2
• rhbk/keycloak-rhel9@sha256:a9aeb0bc33a3461fe2d407896422719b21b184717956cbcebac0da976a220c1c_arm64 as a component of Red Hat build of Keycloak 26.2

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint to trusted networks and clients. Implement firewall rules to limit inbound connections to the Keycloak service port (e.g., 8080) from untrusted sources. If the SAML protocol is not required for your deployment, consider disabling it to eliminate the attack surface. Applying these network restrictions or configuration changes may necessitate a restart or reload of the Keycloak service, which could temporarily affect its availability. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the use of wildcard characters in the "Valid Redirect URIs" field for clients within Keycloak. Instead, explicitly list all allowed redirect URIs. Review all client configurations to ensure that wildcards are not used unless absolutely necessary, and if used, ensure that the client application is robust against open redirect vulnerabilities. Changes to client configurations in Keycloak may require a restart or reload of the Keycloak service to take effect, which could impact active user sessions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (3)

• selfhttps://access.redhat.com/errata/RHSA-2026:19595
• externalhttps://access.redhat.com/security/updates/classification/#important
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19595.json