RHSA-2026:56524: Critical: Red Hat build of Keycloak 26.6.6 Images Security Update
Critical: Red Hat build of Keycloak 26.6.6 Images Security Update
Other sources
Red Hat build of Keycloak is an integrated sign-on solution,available as a Red Hat JBoss Middleware for OpenShift containerizedimage. The Red Hat build of Keycloak for OpenShift image providesan authentication server that you can use to log in centrally, logout, and register. You can also manage user accounts for webapplications, mobile applications, and RESTful web services.Red Hat build of Keycloak Operator for OpenShift simplifiesdeployment and management of Keycloak 26.6.6 clusters.This erratum releases new images for Red Hat build of Keycloak26.6.6 for use within the OpenShift Container Platform cloudcomputing Platform-as-a-Service (PaaS) for on-premise or privatecloud deployments, aligning with the standalone product release.Security fixes: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613) Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571) Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048) Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963) Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat build of Keycloak for OpenShiftto a version that resolves this vulnerability.Fixed in 26.6.6 - Operational
Back up your existing Red Hat build of Keycloak installation before applying the erratum update, including all applications, configuration files, databases and database settings.
Event History
Frequently Asked Questions
Which deployments are in scope for this update?
Organizations using Red Hat build of Keycloak 26.6.6 images on OpenShift Container Platform, including on-premise or private-cloud PaaS deployments, should assess this update. The released images align with the standalone product release.
Do any of the addressed issues allow account takeover without normal user authentication?
The addressed issues include an unauthenticated reset-credentials-flow bypass that can lead to account takeover. Another account-takeover issue involves a malicious OIDC client exploiting a predictable account-linking hash.
What sensitive information could be exposed by the addressed issues?
The update also addresses disclosure of hidden group metadata to callers without group-view permission and leakage of Vault-resolved rotated client secrets through the Admin REST API.