RHSA-2026:50847HighCVSS 8.8

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update

Published
August 5, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (17)

CVE-2026-54513 →CVE-2026-14614 →CVE-2026-14615 →CVE-2026-15572 →CVE-2026-16443 →CVE-2026-16308 →CVE-2026-16442 →CVE-2026-9689 →CVE-2026-9793 →CVE-2026-15573 →CVE-2026-4629 →CVE-2026-9798 →CVE-2026-9800 →CVE-2026-14209 →CVE-2026-16071 →CVE-2026-16102 →CVE-2026-54512 →

📋 Description

CVE-2026-4629 — keycloak: Keycloak: Privilege escalation through hardcoded role mapper injection CVE-2026-9689 — keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 CVE-2026-9793 — keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing CVE-2026-9798 — keycloak: Keycloak: Brute-force protection bypass in CIBA flow CVE-2026-9800 — keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison CVE-2026-14209 — keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions CVE-2026-14614 — keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource CVE-2026-14615 — keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter CVE-2026-15572 — keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation CVE-2026-15573 — keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher CVE-2026-16071 — keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary CVE-2026-16102 — keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers CVE-2026-16308 — io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service CVE-2026-16442 — keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction CVE-2026-16443 — keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-54513 — jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

🎯 Affected products10

  • Red Hat build of Keycloak 26.4
  • rhbk/keycloak-operator-bundle@sha256:2c25b3107aee4f1fc25530f099fa683ba3077c185d581e7caa777c4410383085_amd64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:0d3ea94f75c1b4528722db2c216ff2267ec17ba16adf3f703afb82354f0fdc68_arm64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:330350e0cd77afca88886156c2668ae4bca75865e90362cbcf9657197bfa21e8_amd64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:399c59b8e63de5b6aa4e64008644550b98feb0957214e58dc7c6a5246dde3c87_ppc64le as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9-operator@sha256:f9f35a75d3029edf5ff82351c0b60ad0dd8672c3fa8f22f672954c248f9e0c63_s390x as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:130dfc422476647b5098a317a38964e7ea6a2a3f1a63d91f91dfb993921b356b_ppc64le as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:8a6fd6c12811ce179fc1248c63a152d173c12866b84f8b8364f4f3ed42b7ba58_s390x as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:cc475d34ac199de0908a32efa630c219469076feb74fd970d617c40cc90911f8_arm64 as a component of Red Hat build of Keycloak 26.4
  • rhbk/keycloak-rhel9@sha256:fc0390f65497ad6274f3db55ac796eb792255a8780578ab4d98aec9f42c23bc0_amd64 as a component of Red Hat build of Keycloak 26.4

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that Client-Initiated Backchannel Authentication (CIBA) is not enabled in Keycloak realms unless explicitly required. If CIBA is enabled, consider disabling it to prevent the bypass of brute-force protection mechanisms. Consult Keycloak documentation for instructions on managing CIBA configuration. Workaround: Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application’s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change. As an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.

🔗 References (3)