RHSA-2026:68280
Vulnerability from csaf_redhat - Published: 2026-09-16 15:45 - Updated: 2026-09-16 18:34Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Security Update
Severity
Important
Notes
Topic: New Red Hat build of Keycloak 26.4.16 packages are available from the Customer Portal
Details: Red Hat build of Keycloak 26.4.16 is a standalone server, based on
the Keycloak project, that provides authentication and
standards-based single sign-on capabilities for web and mobile
applications.
Security fixes:
* Privilege escalation via impersonation role allows takeover of realm administrator accounts (CVE-2026-17526)
* SAML Redirect DEFLATE helpers leak native zlib state (CVE-2026-18212)
* Broker-originated username collision causes account lockout (CVE-2026-19607)
* Incomplete fix for arbitrary filesystem path probing via keystore parameters (CVE-2026-19729)
* TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)
* Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments (CVE-2026-74909)
* unauthenticated DoS via unbounded locale caching (CVE-2026-79651)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Keycloak 26.4.16
Red Hat / Red Hat build of Keycloak
|
cpe:/a:redhat:build_keycloak:26.4::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Important
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Moderate
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.
4.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Moderate
A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Important
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Important
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-17526
Threats
Impact
Important
References
33 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New Red Hat build of Keycloak 26.4.16 packages are available from the Customer Portal",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat build of Keycloak 26.4.16 is a standalone server, based on\nthe Keycloak project, that provides authentication and\nstandards-based single sign-on capabilities for web and mobile\napplications.\n\nSecurity fixes:\n* Privilege escalation via impersonation role allows takeover of realm administrator accounts (CVE-2026-17526)\n* SAML Redirect DEFLATE helpers leak native zlib state (CVE-2026-18212)\n* Broker-originated username collision causes account lockout (CVE-2026-19607)\n* Incomplete fix for arbitrary filesystem path probing via keystore parameters (CVE-2026-19729)\n* TLS hostname verification bypass via OpenSSL client path misconfiguration (CVE-2026-62243)\n* Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments (CVE-2026-74909)\n* unauthenticated DoS via unbounded locale caching (CVE-2026-79651)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68280",
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68280.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Security Update",
"tracking": {
"current_release_date": "2026-09-16T18:34:55+00:00",
"generator": {
"date": "2026-09-16T18:34:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.21"
}
},
"id": "RHSA-2026:68280",
"initial_release_date": "2026-09-16T15:45:22+00:00",
"revision_history": [
{
"date": "2026-09-16T15:45:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-16T15:45:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-16T18:34:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Keycloak 26.4.16",
"product": {
"name": "Red Hat build of Keycloak 26.4.16",
"product_id": "Red Hat build of Keycloak 26.4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:build_keycloak:26.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Keycloak"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Orionexe"
]
}
],
"cve": "CVE-2026-17526",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-07-24T14:08:46+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507409"
}
],
"notes": [
{
"category": "description",
"text": "Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that the attacker must already possess the impersonation role. Successful exploitation allows an attacker to gain full administrative control over the realm. The vulnerability\u0027s root cause is a missing privilege-level check on the target user during the impersonation process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-17526"
},
{
"category": "external",
"summary": "RHBZ#2507409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-17526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-17526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17526"
}
],
"release_date": "2026-09-16T12:58:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts"
},
{
"acknowledgments": [
{
"names": [
"Paul Bottinelli"
],
"organization": "Trail of Bits in collaboration with OpenAI"
}
],
"cve": "CVE-2026-18212",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"discovery_date": "2026-07-28T12:27:32+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508307"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by a remote, unauthenticated attacker. Successful exploitation allows an attacker to cause a complete denial of service by exhausting the native memory of the Keycloak process. The vulnerability root cause is the failure to explicitly release native zlib resources in the SAML DEFLATE helper classes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18212"
},
{
"category": "external",
"summary": "RHBZ#2508307",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508307"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18212"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18212",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18212"
}
],
"release_date": "2026-09-16T12:57:23+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state"
},
{
"acknowledgments": [
{
"names": [
"Anurag Mondal"
],
"organization": "NetSPI"
}
],
"cve": "CVE-2026-19607",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-08-11T20:44:22+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514529"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Broker-originated username collision causes account lockout",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to be able to register a specific email address on a trusted external Identity Provider. Successful exploitation allows an attacker to perform a targeted denial-of-service by locking a specific user out of their account. The vulnerability\u0027s root cause is a lack of collision prevention during the first-broker-login authentication flow.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19607"
},
{
"category": "external",
"summary": "RHBZ#2514529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514529"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19607"
}
],
"release_date": "2026-09-16T13:01:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Broker-originated username collision causes account lockout"
},
{
"acknowledgments": [
{
"names": [
"Audax Financial Technology"
]
}
],
"cve": "CVE-2026-19729",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-13T08:57:26+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515294"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires high-level administrative privileges (manage-realm role). Successful exploitation allows an attacker to probe arbitrary filesystem paths to determine the existence and readability of files on the host system. The vulnerabilitys root cause is an incomplete input validation fix in the key provider component of keycloak-services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19729"
},
{
"category": "external",
"summary": "RHBZ#2515294",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515294"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19729"
}
],
"release_date": "2026-08-13T08:57:26+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters"
},
{
"cve": "CVE-2026-62243",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-22T12:51:41.376413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "RHBZ#2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
"url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
}
],
"release_date": "2026-08-22T12:26:43.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
},
{
"acknowledgments": [
{
"names": [
"Stefan Guilhen"
],
"organization": "IBM"
}
],
"cve": "CVE-2026-74909",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-08-13T20:46:27+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517354"
}
],
"notes": [
{
"category": "description",
"text": "Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for a direct bypass of authorization controls. Successful exploitation allows an attacker to reach restricted endpoints they are not authorized to access. The vulnerability\u0027s root cause is an incomplete fix for a previous URI normalization flaw, where encoded characters are not properly handled before the security matching logic is applied.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-74909"
},
{
"category": "external",
"summary": "RHBZ#2517354",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517354"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-74909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74909"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74909",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74909"
}
],
"release_date": "2026-09-16T13:08:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments"
},
{
"acknowledgments": [
{
"names": [
"yd1ng"
]
}
],
"cve": "CVE-2026-79651",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-08-21T10:24:34+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523345"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it can be exploited by an unauthenticated remote attacker. Successful exploitation allows an attacker to cause a complete denial of service by crashing the Keycloak server. The vulnerability\u0027s root cause is the lack of bounds or validation on an in-memory cache used for theme localization, which can be exhausted by providing arbitrary locale tags.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Keycloak 26.4.16"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-79651"
},
{
"category": "external",
"summary": "RHBZ#2523345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-79651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79651"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79651",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79651"
}
],
"release_date": "2026-09-16T13:18:07+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-16T15:45:22+00:00",
"details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68280"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Keycloak 26.4.16"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…