This Red Hat security advisory details multiple vulnerabilities in Keycloak, including authorization bypasses, privilege escalation paths, and denial-of-service vectors across its Admin UI, FGAPv2, DCR, SAML, and LDAP components. The update addresses these issues, requiring an immediate upgrade to Red Hat build of Keycloak version 26.4.14. Administrators must back up their existing installation before applying this patch.
Red Hat Product Errata RHSA-2026:50846 - Security Advisory Issued: 2026-08-05 Updated: 2026-08-05 RHSA-2026:50846 - Security Advisory Overview Synopsis Important: Red Hat build of Keycloak 26.4.14 Security Update Type/Severity Security Advisory: Important Topic New Red Hat build of Keycloak 26.4.14 packages are available from the Customer Portal Description Red Hat build of Keycloak 26.4.14 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions (CVE-2026-14209) FGAP v2 client scope assignment bypass via ClientResource (CVE-2026-14614) FGAP v2 parent group children endpoint bypasses per-child view permission filter (CVE-2026-14615) DCR protocol mapper type-swap policy bypass allows privilege escalation (CVE-2026-15572) Authorization bypass via unnormalized URI matching in PathMatcher (CVE-2026-15573) LDAP entry-DN user search bypasses configured users DN boundary (CVE-2026-16071) Default DCR policy allows role forgery via User Property mappers (CVE-2026-16102) Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308) SAML IdP-initiated broker login bypasses link-only restriction (CVE-2026-16442) SAML broker metadata import disables response signature validation (CVE-2026-16443) Privilege escalation through hardcoded role mapper injection (CVE-2026-4629) Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) Security bypass allows arbitrary code execution (CVE-2026-54513) HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 (CVE-2026-9689) Security policy bypass in JWE-encrypted request object processing (CVE-2026-9793) Brute-force protection bypass in CIBA flow (CVE-2026-9798) Authorization bypass via incorrect URI comparison (CVE-2026-9800) Solution Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Affected Products Red Hat build of Keycloak Text-only Advisories x86_64 Fixes (none) CVEs CVE-2026-4629 CVE-2026-9689 CVE-2026-9793 CVE-2026-9798 CVE-2026-9800 CVE-2026-14209 CVE-2026-14614 CVE-2026-14615 CVE-2026-15572 CVE-2026-15573 CVE-2026-16071 CVE-2026-16102 CVE-2026-16308 CVE-2026-16442 CVE-2026-16443 CVE-2026-54512 CVE-2026-54513 References https://access.redhat.com/security/updates/classification/#important The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .