RHSA-2026:56524CriticalCVSS 9.1

Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Images Security Update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (5)

CVE-2026-17048 →CVE-2026-18963 →CVE-2026-9796 →CVE-2026-14613 →CVE-2026-15571 →

📋 Description

CVE-2026-9796 — keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability CVE-2026-14613 — keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission CVE-2026-15571 — keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client CVE-2026-17048 — keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API CVE-2026-18963 — keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

🎯 Affected products10

  • Red Hat build of Keycloak 26.6
  • rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30_amd64 as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d_arm64 as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18_s390x as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5_amd64 as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e_ppc64le as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178_amd64 as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d_arm64 as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f_ppc64le as a component of Red Hat build of Keycloak 26.6
  • rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7_s390x as a component of Red Hat build of Keycloak 26.6

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If an immediate upgrade is not possible, disabling the "Forgot password" functionality across all realms can be used as a temporary mitigation. In the RHBK administration console, navigate to: Realm settings → Login → Forgot password → Off Apply this setting to all realms. Upgrade to a fixed version as soon as possible.

🔗 References (3)