Red Hat Security Advisory: Red Hat build of Keycloak 26.6.4 Images Security Update
🔗 CVE IDs covered (9)
📋 Description
CVE-2026-6860 — eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name CVE-2026-9083 — keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing CVE-2026-9086 — keycloak: Keycloak: Cross-site scripting (XSS) via case-insensitive URI validation bypass CVE-2026-9099 — keycloak: Group-Admin Escalation to Realm-Admin CVE-2026-9705 — keycloak: Keycloak: Attacker can re-enable and take over disabled clients via Registration Access Token CVE-2026-9795 — keycloak: Keycloak: Privilege escalation via improper scope mapping enforcement CVE-2026-9799 — keycloak: Keycloak: Unauthorized access to resources via UMA permission ticket bypass CVE-2026-9800 — keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison CVE-2026-11800 — org.keycloak:keycloak-services: Keycloak: Authentication bypass via JWT algorithm confusion
🎯 Affected products10
- Red Hat build of Keycloak 26.6
- rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64 as a component of Red Hat build of Keycloak 26.6
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Ensure that only highly trusted administrators are granted the "manage-realm" role within Keycloak. This role provides extensive administrative privileges, including the ability to exploit this vulnerability for filesystem probing. Regularly review and audit users assigned to this role to minimize the attack surface. Workaround: To mitigate this vulnerability, restrict the ability to register new clients and manage existing client configurations. If Dynamic Client Registration is not required, disable it in Keycloak's Realm Settings under Client Registration Policies. If Dynamic Client Registration is necessary, ensure that policies are strictly configured to prevent anonymous client registration and require initial access tokens for all client registrations. Additionally, limit the `manage-client` role to only trusted administrators. Changes to Keycloak configuration may require a service restart or redeployment to take effect. Workaround: To mitigate this issue, restrict network access to the Keycloak Admin REST API to only trusted networks or localhost. This limits the attack surface by preventing unauthorized access to the API endpoints required for exploitation. Consult your network security documentation for specific firewall or network access control configurations. This may impact remote administration capabilities. Workaround: To mitigate this issue, restrict network access to the Keycloak Dynamic Client Registration endpoint. Configure network firewalls to allow connections only from trusted hosts or networks that legitimately require access to this functionality. This limits the exposure of the vulnerable endpoint to unauthorized access attempts. Workaround: To mitigate this issue, disable the Fine-Grained Admin Permissions (FGAPv2) feature in Keycloak if it is not strictly required. This can typically be done by setting `adminPermissionsEnabled` to `false` in the realm configuration. Disabling FGAPv2 will prevent the exploitation of this flaw by removing the vulnerable functionality. However, this may impact administrative delegation capabilities within Keycloak. A restart or reload of the Keycloak service may be required for the changes to take effect. Workaround: To mitigate this issue, ensure that the Keycloak client's policy enforcement mode is set to ENFORCING instead of PERMISSIVE. The PERMISSIVE mode is a non-default configuration that enables the vulnerability. Changing this setting will prevent the unauthorized access to resources of the same type. Consult Keycloak documentation for specific instructions on configuring policy enforcement mode for your client. This change may require a restart or reload of the Keycloak service to take effect and could impact existing authorization policies if not carefully managed.