RHSA-2026:96037: Important: Red Hat build of Keycloak 26.4.18 Security Update
Important: Red Hat build of Keycloak 26.4.18 Security Update
Other sources
Red Hat build of Keycloak 26.4.18 is a standalone server, based onthe Keycloak project, that provides authentication andstandards-based single sign-on capabilities for web and mobileapplications.Security fixes: Connector/J unspecified vulnerability (CPU Apr 2025) (CVE-2025-30706) Authorization bypass via ChainAuthHandler scope validation failure (CVE-2026-102460) Denial of Service via compression bomb (CVE-2026-102477) Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) Authorization bypass in management interface via path concatenation flaw (CVE-2026-107912) SAML redirect binding signature bypass via percent-encoded parameter names (CVE-2026-117691) manage-clients to arbitrary code execution through inline JavaScript policy import (CVE-2026-120984) Data Compromise and Partial Service Interruption (CVE-2026-60623) Denial of Service via unauthenticated network access with user interaction (CVE-2026-60624) Information disclosure vulnerability (CVE-2026-61082)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat build of Keycloakto a version that resolves this vulnerability.Fixed in 26.4.18 - Operational
Before applying the update, back up the existing Red Hat build of Keycloak installation, including all applications, configuration files, databases, and database settings.