Issued:
2026-08-18
Updated:
2026-08-18

RHSA-2026:56523 - Critical: Red Hat build of Keycloak 26.6.6 Security Update

Synopsis

Critical: Red Hat build of Keycloak 26.6.6 Security Update

Type/Severity

Security Advisory: Critical

Topic

New Red Hat build of Keycloak 26.6.6 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.6.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

  • FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613)
  • Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571)
  • Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048)
  • Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
  • Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

ProductVersionArch
Red Hat build of KeycloakText-only Advisoriesx86_64

Fixes

(none)

CVEs

References

Additional information