Red Hat Product Errata RHSA-2026:2366 - Security Advisory
Issued:
2026-02-09
Updated:
2026-02-09

RHSA-2026:2366 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 26.4.9 Images Security Update

Type/Severity

Security Advisory: Important

Topic

New images are available for Red Hat build of Keycloak 26.4.9 and Red Hat build of Keycloak 26.4.9 Operator, running on OpenShift Container Platform

Description

Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.4.9 clusters.

This erratum releases new images for Red Hat build of Keycloak 26.4.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.

Security fixes:

  • Unauthorized organization registration via improper invitation token validation (CVE-2026-1529)
  • Disabled identity providers are still accepted for JWT Authorization Grant (CVE-2026-1486)
  • Incorrect ownership checks in /uma-policy/ (CVE-2025-14778)
  • Unauthorized modification of unmanaged user attributes by administrators (CVE-2026-0871)
  • keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users (CVE-2025-14559)
  • Limited administrator can retrieve sensitive user attributes via Admin API (CVE-2025-13881)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

(none)

aarch64

rhbk/keycloak-rhel9@sha256:8df9fbf1320938c3e708241c78796bcc832d1a11b85be78dd37bbc54630e6365
rhbk/keycloak-rhel9-operator@sha256:718d63c9de563c7339fc6800d7f014c186467b11b2c9b058f88fa9883283180b

ppc64le

rhbk/keycloak-rhel9@sha256:7d3668580a61da509f7b473f8df9197548fb71c465eeaaa53802e7d4e99b84fd
rhbk/keycloak-rhel9-operator@sha256:bcc01dface0582789dae5eb2919ac8ba5a4f5e3e36909a7983a32a0a05d14ae0

s390x

rhbk/keycloak-rhel9@sha256:3f38533ab14d09b0d86394d73a61f3304eef2a19a65e5d5cf87107794d4fc23b
rhbk/keycloak-rhel9-operator@sha256:3fb03c48b66c39429e64eb4f20a110fea755e102285778aae0a8229cb5681be1

x86_64

rhbk/keycloak-operator-bundle@sha256:fd235c7a4820865af18c35441296ae7d40bbd2eea2f7c7b16d5ce9f658c5653b
rhbk/keycloak-rhel9@sha256:71fbf006f8e158fe29b47dfce09757bb004715395c5063b8e317ffd5ef437112
rhbk/keycloak-rhel9-operator@sha256:aa64ecc958ea5569ba023b51d7df1bbc347f7df459a92a23e8b058ae4622b6d4

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.