RHSA-2026:56523: Critical: Red Hat build of Keycloak 26.6.6 Security Update
Red Hat build of Keycloak 26.6.6 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613) Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571) Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048) Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963) Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat build of Keycloak 26.6.6to a version that resolves this vulnerability.Fixed in 26.6.6 - Operational
Back up the existing Red Hat build of Keycloak installation before applying the security update, including all applications, configuration files, databases, and database settings.
Event History
Frequently Asked Questions
Who should prioritize this update?
Organizations running the Red Hat build of Keycloak are exposed to the issues addressed by this security update. The affected server provides authentication and standards-based single sign-on for web and mobile applications, so compromise can affect identities and access managed through it.
What attacker access or conditions are identified for the individual issues?
The advisory identifies several distinct exploit paths: a malicious OIDC client can exploit the predictable account-linking hash, the reset-credentials issue permits unauthenticated account takeover, and the Admin REST API issue can expose vault-resolved rotated client secrets. It also includes unauthorized disclosure of hidden group metadata and a privilege-escalation TOCTOU issue.
Is a default deployment known to be affected, and are temporary mitigations documented?
The available information does not state whether any of these issues affect a default configuration or provide mitigations other than applying the security update. Prioritize restricting exposure of the Keycloak server and its administrative interfaces while planning the update.