RH
Product
Red Hat build of Keycloak 26.6
70
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 23Medium 40Low 4
Watch
Add Red Hat build of Keycloak 26.6 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-19729 | 4.9 | Sep 9 | Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters Affected: All versions, or not specified |
| CVE-2026-16105 | 4.9 | Jul 31 | Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints Affected: All versions, or not specified |
| CVE-2026-17048 | 4.9 | Jul 24 | Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api Affected: All versions, or not specified |
| CVE-2026-16106 | 4.9 | Jul 17 | Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles Affected: All versions, or not specified |
| CVE-2026-16072 | 4.9 | Jul 17 | Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation Affected: All versions, or not specified |
| CVE-2026-14613 | 4.9 | Jul 3 | Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission Affected: All versions, or not specified |
| CVE-2026-9083 | 4.9 | Jun 25 | Keycloak: keycloak: information disclosure through arbitrary filesystem path probing Affected: All versions, or not specified |
| CVE-2026-11986 | 4.9 | Jun 11 | Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak Affected: All versions, or not specified |
| CVE-2026-9801 | 4.9 | May 28 | Keycloak: keycloak: denial of service via malformed ldap password policy response Affected: All versions, or not specified |
| CVE-2026-18209 | 4.7 | Jul 31 | Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check Affected: All versions, or not specified |
| CVE-2026-9799 | 4.6 | Jun 25 | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass Affected: All versions, or not specified |
| CVE-2026-14209 | 4.3 | Jun 30 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions Affected: All versions, or not specified |
| CVE-2026-9798 | 4.3 | May 28 | Keycloak: keycloak: brute-force protection bypass in ciba flow Affected: All versions, or not specified |
| CVE-2026-9791 | 4.3 | May 28 | Keycloak-rhel9: organization data leak after feature disabled in keycloak Affected: All versions, or not specified |
| CVE-2026-8830 | 4.3 | May 19 | Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation Affected: All versions, or not specified |
| CVE-2026-9689 | 4.2 | May 27 | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 Affected: All versions, or not specified |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: All versions, or not specified |
| CVE-2026-15945 | 2.7 | Jul 16 | Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 Affected: All versions, or not specified |
| CVE-2026-14615 | 2.7 | Jul 3 | Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter Affected: All versions, or not specified |
| CVE-2026-9088 | 2.7 | Jun 5 | Keycloak: keycloak: information disclosure due to user profile permission bypass Affected: All versions, or not specified |