Red Hat Product Errata RHSA-2026:95761 - Security Advisory
Issued:
2026-11-06
Updated:
2026-11-06

RHSA-2026:95761 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 26.6.8 Security Update

Type/Severity

Security Advisory: Important

Topic

New Red Hat build of Keycloak 26.6.8 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.6.8 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.

Security fixes:

  • keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint (CVE-2026-101333)
  • keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
  • rhbk/keycloak-rhel9: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read (CVE-2026-103884)
  • keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement (CVE-2026-105305)
  • keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade (CVE-2026-107121)
  • keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing (CVE-2026-107123)
  • keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover (CVE-2026-107124)
  • keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
  • keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation (CVE-2026-107623)
  • keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass (CVE-2026-107889)
  • keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint (CVE-2026-109081)
  • rhbk/keycloak-rhel9-operator: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
  • keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
  • keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache (CVE-2026-110932)
  • keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login (CVE-2026-112208)
  • keycloak-services: keycloak-services: UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
  • rhbk/keycloak-rhel9: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper (CVE-2026-12388)
  • rhbk/keycloak-rhel9: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
  • bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC IdP update reuses masked client secret after token URL change (CVE-2026-15943)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption (CVE-2026-16103)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Group policy extendChildren matches sibling group path prefixes (CVE-2026-18203)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-host wildcard domain matching bypass (CVE-2026-18206)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-group condition bypass via duplicate group name matching (CVE-2026-18207)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim (CVE-2026-18208)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens (CVE-2026-18569)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies (CVE-2026-19608)
  • keycloak/rhbk-openshift-rhel9: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Admin API missing audience check (CVE-2026-19688)
  • rhbk/keycloak-rhel9: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
  • rhbk/keycloak-rhel9: Netty: Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
  • netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
  • rhbk-openshift-rhel9/rhbk-openshift-rhel9: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers (CVE-2026-82968)
  • bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts (CVE-2026-88770)
  • rhbk/keycloak-rhel9: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET (CVE-2026-89298)
  • rhbk/keycloak-rhel9-operator: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase (CVE-2026-91776)
  • jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Residual cross-browser account-link proof allows silent re-linking (CVE-2026-92358)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints (CVE-2026-92856)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
  • netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
  • netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
  • netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
  • netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
  • netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
  • netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
  • netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
  • netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
  • netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
  • netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
  • netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
  • netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
  • netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
  • netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
  • keycloak/rhbk-rhel9-operator: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Token refresh continues issuing tokens for disabled audience clients (CVE-2026-93999)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership (CVE-2026-94000)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Admin credential DELETE bypasses denied reset-password permission (CVE-2026-94001)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity (CVE-2026-94213)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check (CVE-2026-94215)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: UMA scope merge across resource owners via resource name collision (CVE-2026-94217)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint (CVE-2026-94218)
  • keycloak/rhbk-openshift-rhel9: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled (CVE-2026-95503)
  • keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers (CVE-2026-96445)
  • keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path (CVE-2026-96446)
  • keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding (CVE-2026-96447)
  • keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation (CVE-2026-96448)
  • keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
  • keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2 (CVE-2026-96460)
  • keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
  • keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens (CVE-2026-97174)
  • keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
  • keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission (CVE-2026-97177)
  • keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization (CVE-2026-97311)
  • keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
  • keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding (CVE-2026-97846)
  • keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
  • keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

Solution

Before applying the update, back up your existing installation,
including all applications, configuration files, databases and
database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.