Red Hat Security Advisory: Red Hat build of Keycloak 26.4.12 Images Security Update

🔗 CVE IDs covered (10)

📋 Description

🎯 Affected products10

• Red Hat build of Keycloak 26.4
• rhbk/keycloak-operator-bundle@sha256:15286c44c4003e787b0bdf9a0bbc5083a2f2312eaf29ccd0c6943232ff52d729_amd64 as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9-operator@sha256:2a81955051fb0975bfcb77d25ed64c84038d3c7293f910aeb88f9241be531f9d_amd64 as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9-operator@sha256:d8185614aa82117680351c710a5d7b80703a9d450dd02a7becfd1405cbc5ecd5_ppc64le as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9-operator@sha256:d915c75947df63aed99031401dbf570181dba3c5a484eb88438a27892eb7aa72_s390x as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9-operator@sha256:f80c9568ff4b3cc086b7107c8e68db5f548c2b51a01dd8c79d0c9705574a180c_arm64 as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9@sha256:554cd90241225b6d64d0e7ada9a8ab50ae2054efdb2f5b2cbdb721475ea296df_arm64 as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9@sha256:68b61a98fcdfd46a166cabe097d609d65fd51181860f9ec7f691bbe5d2a986db_s390x as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9@sha256:81773a34d38a8df4b07344fe4ba5670d18684b3579c9d2cf8d0690bf5ec5ab40_amd64 as a component of Red Hat build of Keycloak 26.4
• rhbk/keycloak-rhel9@sha256:fa7342d82f080bfe8ffaaf5ba204b98dc435897a388b1501d23a1541fe7f1272_ppc64le as a component of Red Hat build of Keycloak 26.4

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as `169.254.169.254`. For example, on Red Hat Enterprise Linux, you can use `firewalld` to add a rich rule: `sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" destination address="169.254.169.254" reject'` `sudo firewall-cmd --reload` This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured `sector_identifier_uri` values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint to trusted networks and clients. Implement firewall rules to limit inbound connections to the Keycloak service port (e.g., 8080) from untrusted sources. If the SAML protocol is not required for your deployment, consider disabling it to eliminate the attack surface. Applying these network restrictions or configuration changes may necessitate a restart or reload of the Keycloak service, which could temporarily affect its availability. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the use of wildcard characters in the "Valid Redirect URIs" field for clients within Keycloak. Instead, explicitly list all allowed redirect URIs. Review all client configurations to ensure that wildcards are not used unless absolutely necessary, and if used, ensure that the client application is robust against open redirect vulnerabilities. Changes to client configurations in Keycloak may require a restart or reload of the Keycloak service to take effect, which could impact active user sessions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, restrict network access to the Keycloak authentication endpoint to trusted clients and networks. Implement firewall rules to control inbound connections to the Keycloak service ports, thereby reducing the attack surface and limiting who can initiate authentication flows and potentially exploit the implicit flow bypass. If the Keycloak service is reloaded or restarted, ensure these network restrictions remain in effect. Workaround: To mitigate this issue, consider disabling WebAuthn required actions in Keycloak if they are not essential for your deployment. This will prevent the vulnerable token replay mechanism from being exploited. Consult Keycloak documentation for specific configuration steps to disable WebAuthn required actions. Note that applying configuration changes may require a service restart and could impact functionality relying on WebAuthn registration.

🔗 References (3)

• selfhttps://access.redhat.com/errata/RHSA-2026:19597
• externalhttps://access.redhat.com/security/updates/classification/#important
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19597.json