RHSA-2026:56519: Critical: Red Hat build of Keycloak 26.4.15 Images Security Update
Critical: Red Hat build of Keycloak 26.4.15 Images Security Update
Other sources
Red Hat build of Keycloak is an integrated sign-on solution,available as a Red Hat JBoss Middleware for OpenShift containerizedimage. The Red Hat build of Keycloak for OpenShift image providesan authentication server that you can use to log in centrally, logout, and register. You can also manage user accounts for webapplications, mobile applications, and RESTful web services.Red Hat build of Keycloak Operator for OpenShift simplifiesdeployment and management of Keycloak 26.4.15 clusters.This erratum releases new images for Red Hat build of Keycloak26.4.15 for use within the OpenShift Container Platform cloudcomputing Platform-as-a-Service (PaaS) for on-premise or privatecloud deployments, aligning with the standalone product release.Security fixes: Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat build of Keycloak (OpenShift container image)to a version that resolves this vulnerability.Fixed in 26.4.15 - Operational
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.
Event History
Frequently Asked Questions
Which deployments are in scope for this update?
Deployments using the Red Hat build of Keycloak 26.4.15 images on OpenShift are the affected scope identified by this erratum. The issue concerns the reset-credentials flow in the authentication server.
Does exploitation require an authenticated attacker?
The security fix addresses an unauthenticated account-takeover path through a reset-credentials flow bypass. No prerequisite attacker access or additional configuration conditions are provided in the advisory.
What can be done if the issue needs to be remediated?
The provided information does not describe temporary mitigations, configuration workarounds, or detection methods. Applying the updated images released by the erratum is the remediation identified.