Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Images Security Update
🔗 CVE IDs covered (28)
📋 Description
CVE-2026-15945 — keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 CVE-2026-16072 — keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation CVE-2026-16089 — keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session CVE-2026-16093 — keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16104 — keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins CVE-2026-16105 — keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints CVE-2026-16106 — keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles CVE-2026-16108 — keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 CVE-2026-17059 — keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter CVE-2026-17526 — keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts CVE-2026-17615 — resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-18201 — keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations CVE-2026-18209 — keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check CVE-2026-18212 — keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state CVE-2026-18214 — keycloak-services: keycloak-services: Google external access-token exchange bypasses hosted-domain restriction CVE-2026-18215 — keycloak-services: keycloak-services: Microsoft external access-token exchange bypasses configured tenant CVE-2026-18218 — keycloak-services: keycloak-services: Client not-before revocation ignored when realm not-before is older but nonzero CVE-2026-18570 — keycloak-services: keycloak-services: Full-scope-disabled client policy validation bypass via omitted fullScopeAllowed CVE-2026-18571 — keycloak-services: keycloak-services: FGAP V2 group assignment bypass during user creation CVE-2026-18572 — keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes CVE-2026-18573 — keycloak-services: keycloak-services: Client access-type policy condition bypass during client update CVE-2026-19607 — keycloak-services: keycloak-services: Broker-originated username collision causes account lockout CVE-2026-19729 — keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters CVE-2026-42211 — react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode CVE-2026-62243 — io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration CVE-2026-74909 — keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments CVE-2026-79651 — keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching CVE-2026-79652 — keycloak-services: keycloak-services: JWT Bearer authorization grant does not enforce consentRequired
🎯 Affected products10
- Red Hat build of Keycloak 26.6
- rhbk/keycloak-operator-bundle@sha256:214bd43b28c8f61d9c8f81f57e9dd3027d09cb3c00fb307bd265130147dd419b_amd64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:17799b1e42dac3e81023c17319e0250b89d0fd689e2910b57443e311f2810ef2_arm64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:9f74c98693761db4e065a3d7a28b04c8f60abcb37b6cc48bd4926cbbb5e3e788_ppc64le as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:de43455a4604ac89363ee40c3fe8f8641b905380413a1abd91ee7d3416e6a356_amd64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9-operator@sha256:eeb387096bac9dd17f2a7e48071602ef4e27902204cbe8856c3f04303212d6a6_s390x as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:118e76caf2bb91d04091c2e7dc20a163fcb9b218e44fd5f2ca298db669eed059_ppc64le as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:2b0f46c7a7aa9c580d509030054bb5f4a233f9ec38e2c79e7b0c98b9b0f79d96_s390x as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:3eac2479ff615aa8ab099e7b669a98dd6978753b7dc51582fe899ac756ae18f4_arm64 as a component of Red Hat build of Keycloak 26.6
- rhbk/keycloak-rhel9@sha256:7711b8114aef173846b601a776d85640832b371421c57b6506e5df334ed96dd6_amd64 as a component of Red Hat build of Keycloak 26.6
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect. Workaround: To mitigate this vulnerability, ensure that applications using React Router are not configured in Framework Mode. Instead, utilize Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`), as these modes are not susceptible to this flaw. Workaround: This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). The following mitigations can reduce exposure without applying a patch: 1) Use the default JDK SSL provider — Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden. 2) Use X509ExtendedTrustManager — If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic. 3) Run on Java 24 or earlier — The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.