Red Hat Product Errata RHSA-2026:95760 - Security Advisory
Issued:
2026-11-06
Updated:
2026-11-06

RHSA-2026:95760 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 26.4.17 Images Security Update

Type/Severity

Security Advisory: Important

Topic

New images are available for Red Hat build of Keycloak 26.4.17 and Red Hat build of Keycloak 26.4.17 Operator, running on OpenShift Container Platform

Description

Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.

Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.4.17 clusters.

This erratum releases new images for Red Hat build of Keycloak
26.4.17 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.

Security fixes:

  • Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
  • Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
  • PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
  • Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
  • UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
  • Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
  • Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
  • SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
  • Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
  • Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
  • Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
  • SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
  • SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
  • Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
  • Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
  • SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
  • DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
  • Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
  • Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
  • HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
  • Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
  • Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
  • HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
  • Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
  • HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
  • HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
  • HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
  • HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
  • Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
  • HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
  • HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
  • SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
  • kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
  • DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
  • Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
  • DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
  • Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
  • Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

Solution

Before applying the update, back up your existing installation,
including all applications, configuration files, databases and
database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

(none)

aarch64

rhbk/keycloak-rhel9@sha256:53421ea2dcb298526f95ffa9025d2ce0ce8759fe5ad2e2b6b92f7e403dd998f6
rhbk/keycloak-rhel9-operator@sha256:c7786749caf4e73a81309fe02bfb98a5e9dcd5b16300348724158a29bfea73df

ppc64le

rhbk/keycloak-rhel9@sha256:edc68f24d5c3914521bb945b0ec7cf69b8ce1197d2d91d79fa316da76b85238e
rhbk/keycloak-rhel9-operator@sha256:5ebe29062bf19bf768bab690bdeb02edf25645b4f07c784ff4db616bf079a353

s390x

rhbk/keycloak-rhel9@sha256:7b52ea376804c0a113193693046dbd4b252bc97bf562b4a9ba6f13e6241cec7d
rhbk/keycloak-rhel9-operator@sha256:d682d96cdb417bc99a7bafca2628c922609e3dc94a078d7d81219bb2bba39872

x86_64

rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d
rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907
rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.