Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Security Update
🔗 CVE IDs covered (19)
📋 Description
CVE-2026-9689 — keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 CVE-2026-9793 — keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing CVE-2026-9798 — keycloak: Keycloak: Brute-force protection bypass in CIBA flow CVE-2026-11986 — keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak CVE-2026-14209 — keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions CVE-2026-14614 — keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource CVE-2026-14615 — keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter CVE-2026-15572 — keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation CVE-2026-15573 — keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher CVE-2026-16071 — keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary CVE-2026-16100 — keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text CVE-2026-16102 — keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers CVE-2026-16308 — io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service CVE-2026-16442 — keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction CVE-2026-16443 — keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation CVE-2026-40983 — micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests CVE-2026-40984 — micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-54513 — jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
🎯 Affected products1
- Red Hat build of Keycloak 26.6.5
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, ensure that Client-Initiated Backchannel Authentication (CIBA) is not enabled in Keycloak realms unless explicitly required. If CIBA is enabled, consider disabling it to prevent the bypass of brute-force protection mechanisms. Consult Keycloak documentation for instructions on managing CIBA configuration. Workaround: To mitigate this issue, restrict network access to services exposing Micrometer's gRPC endpoints to trusted clients only. Implement firewall rules to limit inbound connections to the specific ports used by gRPC. If gRPC functionality is not essential for the deployment, consider disabling it entirely to eliminate the attack vector. Any changes to network configurations or service settings may require a service restart to take effect, potentially impacting availability during the transition. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Upgrade to version 2.18.8, 2.21.4, or 3.1.4 or later to address this vulnerability. If upgrading is not immediately possible, remove BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() from the application’s ObjectMapper configuration to eliminate the affected deserialization path. Rebuild and restart the application to apply the configuration change. As an additional mitigation, disable polymorphic deserialization of untrusted data where possible by avoiding or removing default typing features such as activateDefaultTyping() or enableDefaultTyping(). When polymorphic deserialization is required, restrict allowed subtypes using a strict whitelist of trusted application packages and avoid broad or permissive type validation rules.