RHSA-2026:96038: Important: Red Hat build of Keycloak 26.4.18 Images Security Update

Red Hat build of Keycloak is an integrated sign-on solution,available as a Red Hat JBoss Middleware for OpenShift containerizedimage. The Red Hat build of Keycloak for OpenShift image providesan authentication server that you can use to log in centrally, logout, and register. You can also manage user accounts for webapplications, mobile applications, and RESTful web services.Red Hat build of Keycloak Operator for OpenShift simplifiesdeployment and management of Keycloak 26.4.18 clusters.This erratum releases new images for Red Hat build of Keycloak26.4.18 for use within the OpenShift Container Platform cloudcomputing Platform-as-a-Service (PaaS) for on-premise or privatecloud deployments, aligning with the standalone product release.Security fixes: Connector/J unspecified vulnerability (CPU Apr 2025) (CVE-2025-30706) Authorization bypass via ChainAuthHandler scope validation failure (CVE-2026-102460) Denial of Service via compression bomb (CVE-2026-102477) Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554) Authorization bypass in management interface via path concatenation flaw (CVE-2026-107912) SAML redirect binding signature bypass via percent-encoded parameter names (CVE-2026-117691) manage-clients to arbitrary code execution through inline JavaScript policy import (CVE-2026-120984) Data Compromise and Partial Service Interruption (CVE-2026-60623) Denial of Service via unauthenticated network access with user interaction (CVE-2026-60624) Information disclosure vulnerability (CVE-2026-61082)

— Red Hat