SB2026091144 - Multiple vulnerabilities in Red Hat build of Keycloak
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-9796)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to realm-admin for all users within the realm.
The vulnerability exists due to a time-of-check to time-of-use race condition in name-based admin role checks when processing administrative role checks. A remote privileged user can exploit the race condition to escalate privileges to realm-admin for all users within the realm.
Exploitation requires the manage-clients role. The resulting composite role relationship persists after the user\'s permissions are revoked and across system reboots.
2) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-14613)
CWE-ID: CWE-1220 - Insufficient Granularity of Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive group information.
The vulnerability exists due to insufficient granularity of access control in Keycloak\'s administrative interface when viewing groups assigned to a role. A remote user can view groups assigned to a role they are permitted to view to disclose sensitive group information.
Only instances with Fine-Grained Admin Permissions version 2 enabled are affected.
3) Predictable from Observable State (CVE-ID: CVE-2026-15571)
CWE-ID: CWE-341 - Predictable from Observable State
CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to take over a victim\'s account.
The vulnerability exists due to predictable hash generation in the legacy client-initiated account-linking endpoint when processing account-linking requests. A remote user can trick a user into authenticating and forge a valid linking URL to connect the victim\'s account to an attacker-controlled external identity to take over a victim\'s account.
User interaction is required to authenticate.
4) Information disclosure (CVE-ID: CVE-2026-17048)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive credentials.
The vulnerability exists due to improper boundary enforcement in the Keycloak Admin REST API when processing requests for rotated client secrets stored in a secure vault. A remote privileged user can retrieve resolved secrets instead of vault placeholders to disclose sensitive credentials.
Exploitation requires delegated administrator permissions that are limited to viewing resources.
5) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2026-18963)
CWE-ID: CWE-640 - Weak password recovery mechanism
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over arbitrary user accounts.
The vulnerability exists due to a weak password recovery mechanism in the reset-credentials flow of the keycloak-services component when handling password reset requests. A remote attacker can bypass the required email verification link and set new credentials to take over arbitrary user accounts.
Remediation
Install update from vendor's website.