RHSA-2026:95762 - Security Advisory

Topic

New images are available for Red Hat build of Keycloak 26.6.8 and
Red Hat build of Keycloak 26.6.8 Operator, running on OpenShift
Container Platform

Description

Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.

Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.6.8 clusters.

This erratum releases new images for Red Hat build of Keycloak
26.6.8 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.

Security fixes:

• keycloak-services: keycloak-services: Unbounded metric series creation via idp tag on broker login endpoint (CVE-2026-101333)
• keycloak-services: keycloak-services: Account takeover via authentication race using reset-credentials path (CVE-2026-103112)
• rhbk/keycloak-rhel9: keycloak-services: Path traversal in X.509 CRL Distribution Point allows arbitrary local file read (CVE-2026-103884)
• keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement (CVE-2026-105305)
• keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade (CVE-2026-107121)
• keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing (CVE-2026-107123)
• keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover (CVE-2026-107124)
• keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop (CVE-2026-107602)
• keycloak-services: keycloak-services: OIDC DCR read-modify-write silently disables offline token revocation (CVE-2026-107623)
• keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass (CVE-2026-107889)
• keycloak-services: keycloak-services: Injection of roles into realm default-roles via DCR endpoint (CVE-2026-109081)
• rhbk/keycloak-rhel9-operator: Jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CV (CVE-2026-110879)
• keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931)
• keycloak-services: keycloak-services: Unauthenticated persistent disk exhaustion via theme gzip cache (CVE-2026-110932)
• keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login (CVE-2026-112208)
• keycloak-services: keycloak-services: UMA Protection API resourceType field not validated — cross-owner resource access (CVE-2026-114232)
• rhbk/keycloak-rhel9: Keycloak: Privilege escalation to realm administrator via improper authorization in identity provider mapper (CVE-2026-12388)
• rhbk/keycloak-rhel9: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860)
• bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing (CVE-2026-13506)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC IdP update reuses masked client secret after token URL change (CVE-2026-15943)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption (CVE-2026-16103)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Group policy extendChildren matches sibling group path prefixes (CVE-2026-18203)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-host wildcard domain matching bypass (CVE-2026-18206)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Client policy source-group condition bypass via duplicate group name matching (CVE-2026-18207)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim (CVE-2026-18208)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: SAML HTTP-Redirect binding response preserves query string leading to parameter pollution (CVE-2026-18217)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens (CVE-2026-18569)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Name-only group claims let same-name groups satisfy path-specific group policies (CVE-2026-19608)
• keycloak/rhbk-openshift-rhel9: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding (CVE-2026-19611)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: keycloak-services: Admin API missing audience check (CVE-2026-19688)
• rhbk/keycloak-rhel9: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names (CVE-2026-58059)
• rhbk/keycloak-rhel9: Netty: Information disclosure via CORS Vary header overwrite (CVE-2026-59903)
• netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVE-2026-75595)
• rhbk-openshift-rhel9/rhbk-openshift-rhel9: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass (CVE-2026-77874)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing (CVE-2026-82965)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-session email verification proof not bound to upstream identity for social providers (CVE-2026-82968)
• bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI (CVE-2026-8763)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts (CVE-2026-88770)
• rhbk/keycloak-rhel9: keycloak-services: Confidential client secret disclosed to view-clients role via Client Registration GET (CVE-2026-89298)
• rhbk/keycloak-rhel9-operator: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase (CVE-2026-91776)
• jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Residual cross-browser account-link proof allows silent re-linking (CVE-2026-92358)
• keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession (CVE-2026-92855)
• keycloak/rhbk-openshift-rhel9: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints (CVE-2026-92856)
• keycloak/rhbk-openshift-rhel9: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens (CVE-2026-92857)
• netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams (CVE-2026-93488)
• netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (CVE-2026-93491)
• netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size (CVE-2026-93492)
• netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (CVE-2026-93558)
• netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (CVE-2026-93562)
• netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) (CVE-2026-93564)
• netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte (CVE-2026-93565)
• netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line (CVE-2026-93566)
• netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (CVE-2026-93567)
• netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (CVE-2026-93568)
• netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (CVE-2026-93569)
• netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling (CVE-2026-93573)
• netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing (CVE-2026-93574)
• netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) (CVE-2026-93579)
• keycloak/rhbk-rhel9-operator: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Token refresh continues issuing tokens for disabled audience clients (CVE-2026-93999)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membership (CVE-2026-94000)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Admin credential DELETE bypasses denied reset-password permission (CVE-2026-94001)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Authorization Services policy evaluation endpoint leaks user identity (CVE-2026-94213)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership check (CVE-2026-94215)
• keycloak/rhbk-openshift-rhel9: keycloak-services: UMA scope merge across resource owners via resource name collision (CVE-2026-94217)
• keycloak/rhbk-openshift-rhel9: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpoint (CVE-2026-94218)
• keycloak/rhbk-openshift-rhel9: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled (CVE-2026-95503)
• keycloak-services: keycloak-services: Conditional OTP skip-header policy evaluated against untrusted proxy headers (CVE-2026-96445)
• keycloak-services: keycloak-services: PAR single-use bypass via prompt=none silent authentication path (CVE-2026-96446)
• keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding (CVE-2026-96447)
• keycloak-services: keycloak-services: FGAP v2 composite-blind role mapping allows privilege escalation (CVE-2026-96448)
• keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVE-2026-96453)
• keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2 (CVE-2026-96460)
• keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles (CVE-2026-96547)
• keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens (CVE-2026-97174)
• keycloak-services: keycloak-services: Unverified IdP email auto-linking enables account takeover (CVE-2026-97175)
• keycloak-services: keycloak-services: Generic user update bypasses denied reset-password permission (CVE-2026-97177)
• keycloak-services: keycloak-services: Admin REST API role-groups endpoint discloses groups without authorization (CVE-2026-97311)
• keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover (CVE-2026-97367)
• keycloak-services: keycloak-services: Standard Token Exchange V2 bypasses mTLS holder-of-key binding (CVE-2026-97846)
• keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority (CVE-2026-97847)
• keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization (CVE-2026-97848)

Solution

Before applying the update, back up your existing installation,
including all applications, configuration files, databases and
database settings, and so on.

Affected Products

• Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

CVEs

• CVE-2026-8763
• CVE-2026-12388
• CVE-2026-12860
• CVE-2026-13506
• CVE-2026-15943
• CVE-2026-16103
• CVE-2026-18203
• CVE-2026-18206
• CVE-2026-18207
• CVE-2026-18208
• CVE-2026-18217
• CVE-2026-18569
• CVE-2026-19608
• CVE-2026-19611
• CVE-2026-19688
• CVE-2026-58059
• CVE-2026-59903
• CVE-2026-75595
• CVE-2026-77874
• CVE-2026-82965
• CVE-2026-82968
• CVE-2026-83374
• CVE-2026-83376
• CVE-2026-83378
• CVE-2026-83380
• CVE-2026-83381
• CVE-2026-83387
• CVE-2026-83395
• CVE-2026-83400
• CVE-2026-87290
• CVE-2026-87291
• CVE-2026-87292
• CVE-2026-87294
• CVE-2026-87367
• CVE-2026-88770
• CVE-2026-89298
• CVE-2026-91332
• CVE-2026-91333
• CVE-2026-91334
• CVE-2026-91335
• CVE-2026-91373
• CVE-2026-91374
• CVE-2026-91375
• CVE-2026-91379
• CVE-2026-91380
• CVE-2026-91394
• CVE-2026-91397
• CVE-2026-91398
• CVE-2026-91400
• CVE-2026-91410
• CVE-2026-91415
• CVE-2026-91418
• CVE-2026-91451
• CVE-2026-91452
• CVE-2026-91453
• CVE-2026-91461
• CVE-2026-91462
• CVE-2026-91463
• CVE-2026-91464
• CVE-2026-91487
• CVE-2026-91776
• CVE-2026-91777
• CVE-2026-92358
• CVE-2026-92855
• CVE-2026-92856
• CVE-2026-92857
• CVE-2026-93488
• CVE-2026-93491
• CVE-2026-93492
• CVE-2026-93558
• CVE-2026-93562
• CVE-2026-93564
• CVE-2026-93565
• CVE-2026-93566
• CVE-2026-93567
• CVE-2026-93568
• CVE-2026-93569
• CVE-2026-93573
• CVE-2026-93574
• CVE-2026-93579
• CVE-2026-93998
• CVE-2026-93999
• CVE-2026-94000
• CVE-2026-94001
• CVE-2026-94213
• CVE-2026-94215
• CVE-2026-94217
• CVE-2026-94218
• CVE-2026-95503
• CVE-2026-96445
• CVE-2026-96446
• CVE-2026-96447
• CVE-2026-96448
• CVE-2026-96453
• CVE-2026-96460
• CVE-2026-96547
• CVE-2026-97174
• CVE-2026-97175
• CVE-2026-97177
• CVE-2026-97311
• CVE-2026-97367
• CVE-2026-97846
• CVE-2026-97847
• CVE-2026-97848
• CVE-2026-101333
• CVE-2026-101516
• CVE-2026-103112
• CVE-2026-103884
• CVE-2026-105305
• CVE-2026-107121
• CVE-2026-107123
• CVE-2026-107124
• CVE-2026-107602
• CVE-2026-107623
• CVE-2026-107889
• CVE-2026-109081
• CVE-2026-110879
• CVE-2026-110931
• CVE-2026-110932
• CVE-2026-112208
• CVE-2026-114232

References

• https://access.redhat.com/security/updates/classification/#important