RHSA-2026:3948HighCVSS 8.8

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Images Update

Published
March 5, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (8)

CVE-2026-2575 →CVE-2026-2603 →CVE-2026-2733 →CVE-2026-3009 →CVE-2026-3047 →CVE-2026-0707 →CVE-2026-1190 →CVE-2026-2092 →

📋 Description

CVE-2026-0707 — keycloak: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass CVE-2026-1190 — org.keycloak/keycloak-services: Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData CVE-2026-2092 — keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions CVE-2026-2575 — keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression CVE-2026-2603 — keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider CVE-2026-2733 — org.keycloak/keycloak-services: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol CVE-2026-3009 — org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass) CVE-2026-3047 — org.keycloak.broker.saml: Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

🎯 Affected products10

  • Red Hat build of Keycloak 26.4
  • rhbk/keycloak-operator-bundle@sha256:ae13f29ccde0ddf5d96d14567177fcdfa2dd12cb29ca7793b47c857436d2a3e8_amd64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:2ff84fdf2ccf5ef7fb360d0b33b7369ae948b7eba84926320431adb1da23d9a7_arm64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:adc45a57c1cc6f816e6c0074cd9aeba6c6b323a0c708d5d11678bb49af578a6a_amd64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:cbb01b2cdd4857eddc5c94a1382c11901883d0df6176593a099d01791f6b72bf_s390x as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:edeb162dfffdcaf118c3fa7b951a563de58a88b4604764c8651396056e6ba814_ppc64le as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:48fa03e7e881b996085a2207878c6ab610fa770fbedf41f195d270aefb8bf9f7_arm64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:73cf1a2410318ef2e508c21dc5c3332d3f3658eaab7d9b0e4dadfb570c002899_ppc64le as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:884c31d8ddfd03349a65bc76851cdf83d7cf8db0983e9e8c52a648298cd8c7eb_amd64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:b0efe038b71e19b53e41ccede51fefcd03d81e2aafd6fa0b23b5b9c8dac212fd_s390x as a component of Red Hat build of Keycloak 26.4

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: To mitigate this issue, configure any front-end security controls, such as Web Application Firewalls (WAFs) or reverse proxies, to strictly validate and normalize the `Authorization` header before forwarding requests to Keycloak. This ensures that only standard Bearer token formats are processed, preventing potential bypasses. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, ensure that any SAML client intended to be disabled is not configured as an IdP-initiated broker landing target within Keycloak. Review your Keycloak realm configurations to identify and remove any such associations for disabled clients.

🔗 References (3)