SB20260921141 - Multiple vulnerabilities in Red Hat build of Keycloak 26.4
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-17526)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain full administrative control over a realm.
The vulnerability exists due to missing authorization in Keycloak impersonation functionality when impersonating users. A remote privileged user can impersonate a realm administrator to gain full administrative control over a realm.
2) Memory leak (CVE-ID: CVE-2026-18212)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing release of memory after effective lifetime in the custom DEFLATE compression and decompression helpers of the SAML Redirect Binding implementation when processing repeated malformed SAML requests. A remote attacker can send repeated malformed SAML requests to cause a denial of service.
3) Improper Authentication (CVE-ID: CVE-2026-19607)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper authentication in the first-broker-login flow of the keycloak-services component when linking an account through an external identity provider. A remote attacker can register a matching username with an external identity provider to cause a denial of service.
4) Path traversal (CVE-ID: CVE-2026-19729)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to probe the filesystem.
The vulnerability exists due to improper limitation of a pathname in core relative path handling when processing a supplied relative path. A remote attacker can supply a crafted relative path to probe the filesystem.
5) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-62243)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS hostname verification and disclose sensitive information.
The vulnerability exists due to improper validation of certificate with host mismatch in the OpenSSL client path when using a plain X509TrustManager and trust-manager wrapping is unavailable. A remote attacker can present a certificate for a mismatched hostname to bypass TLS hostname verification and disclose sensitive information.
This affects the SslProvider.OPENSSL path on Java 25+ when Unsafe-based reflection is unavailable and a non-extended X509TrustManager is used.
6) Improper Authorization (CVE-ID: CVE-2026-15573)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authorization and access restricted areas.
The vulnerability exists due to improper access control in the PathMatcher component when handling request paths containing unnormalized URIs. A remote user can send a specially crafted request with a trailing slash or matrix parameters to bypass authorization and access restricted areas.
The issue can cause less restrictive security policies to be applied than intended, including exposure of administrative areas.
7) Missing Authorization (CVE-ID: CVE-2026-74909)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized access to sensitive administrative or private application endpoints.
The vulnerability exists due to missing authorization in the Keycloak policy enforcer when processing web addresses containing specially encoded characters. A remote user can send a request containing encoded semicolons or directory traversal segments to cause the enforcer to apply a less restrictive security policy.
8) Resource exhaustion (CVE-ID: CVE-2026-79651)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the theme localization endpoints of the keycloak-services component when processing unauthenticated requests containing arbitrary locale tags. A remote attacker can send a large number of unique locale tags to exhaust memory and cause a denial of service.
The supplied locale tags are stored in a permanent in-memory cache without limits.
Remediation
Install update from vendor's website.