Red Hat Product Errata RHSA-2026:96037 - Security Advisory
Issued:
2026-11-07
Updated:
2026-11-07

RHSA-2026:96037 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 26.4.18 Security Update

Type/Severity

Security Advisory: Important

Topic

New Red Hat build of Keycloak 26.4.18 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.4.18 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.

Security fixes:

  • Connector/J unspecified vulnerability (CPU Apr 2025) (CVE-2025-30706)
  • Authorization bypass via ChainAuthHandler scope validation failure (CVE-2026-102460)
  • Denial of Service via compression bomb (CVE-2026-102477)
  • Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554)
  • Authorization bypass in management interface via path concatenation flaw (CVE-2026-107912)
  • SAML redirect binding signature bypass via percent-encoded parameter names (CVE-2026-117691)
  • manage-clients to arbitrary code execution through inline JavaScript policy import (CVE-2026-120984)
  • Data Compromise and Partial Service Interruption (CVE-2026-60623)
  • Denial of Service via unauthenticated network access with user interaction (CVE-2026-60624)
  • Information disclosure vulnerability (CVE-2026-61082)

Solution

Before applying the update, back up your existing installation,
including all applications, configuration files, databases and
database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

(none)

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.