Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Security Update
🔗 CVE IDs covered (28)
📋 Description
CVE-2026-15945 — keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 CVE-2026-16072 — keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation CVE-2026-16089 — keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session CVE-2026-16093 — keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16104 — keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins CVE-2026-16105 — keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints CVE-2026-16106 — keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles CVE-2026-16108 — keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 CVE-2026-17059 — keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter CVE-2026-17526 — keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts CVE-2026-17615 — resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-18201 — keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations CVE-2026-18209 — keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check CVE-2026-18212 — keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state CVE-2026-18214 — keycloak-services: keycloak-services: Google external access-token exchange bypasses hosted-domain restriction CVE-2026-18215 — keycloak-services: keycloak-services: Microsoft external access-token exchange bypasses configured tenant CVE-2026-18218 — keycloak-services: keycloak-services: Client not-before revocation ignored when realm not-before is older but nonzero CVE-2026-18570 — keycloak-services: keycloak-services: Full-scope-disabled client policy validation bypass via omitted fullScopeAllowed CVE-2026-18571 — keycloak-services: keycloak-services: FGAP V2 group assignment bypass during user creation CVE-2026-18572 — keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes CVE-2026-18573 — keycloak-services: keycloak-services: Client access-type policy condition bypass during client update CVE-2026-19607 — keycloak-services: keycloak-services: Broker-originated username collision causes account lockout CVE-2026-19729 — keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters CVE-2026-42211 — react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode CVE-2026-62243 — io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration CVE-2026-74909 — keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments CVE-2026-79651 — keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching CVE-2026-79652 — keycloak-services: keycloak-services: JWT Bearer authorization grant does not enforce consentRequired
🎯 Affected products1
- Red Hat build of Keycloak 26.6.7
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect. Workaround: To mitigate this vulnerability, ensure that applications using React Router are not configured in Framework Mode. Instead, utilize Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`), as these modes are not susceptible to this flaw. Workaround: This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). The following mitigations can reduce exposure without applying a patch: 1) Use the default JDK SSL provider — Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden. 2) Use X509ExtendedTrustManager — If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic. 3) Run on Java 24 or earlier — The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.