The Red Hat build of Keycloak 26.2.14 images update addresses three security vulnerabilities: CVE-2026-3047, an authentication bypass due to a disabled SAML client completing an IdP-initiated login; CVE-2026-2603, unauthorized authentication via a disabled SAML Identity Provider; and CVE-2026-2092, unauthorized access resulting from improper validation of encrypted SAML assertions. These vulnerabilities affect the SAML broker and identity provider components of Keycloak, potentially allowing unauthorized authentication and access. The update provides new container images for Red Hat build of Keycloak 26.2.14 and its operator for OpenShift, intended for on-premise or private cloud deployments.

Successful exploitation of these vulnerabilities could allow attackers to bypass authentication controls and gain unauthorized access to applications and services protected by the affected Keycloak instances. This compromises the integrity of the authentication process and could lead to unauthorized user account management and access to protected resources.

Red Hat has released updated images for Red Hat build of Keycloak 26.2.14 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the updated Keycloak 26.2.14 images and operator is the recommended remediation. Since a patch is available, deploying the updated images will mitigate the vulnerabilities.