This advisory covers five security vulnerabilities in the Red Hat build of Keycloak 26.2.15, a containerized authentication server for OpenShift. The issues include CVE-2026-3872 (redirect_uri validation bypass causing information disclosure), CVE-2026-4325 (replay of action tokens due to improper single-use token handling), CVE-2026-4636 (UMA policy bypass allowing authenticated users unauthorized access to victim-owned resources), CVE-2026-4282 (privilege escalation via forged authorization codes exploiting SingleUseObjectProvider isolation flaw), and CVE-2026-4634 (denial of service via excessive processing of OpenID Connect scope parameters). Red Hat has released new container images for Keycloak 26.2.15 and its operator to address these issues for on-premise or private cloud OpenShift deployments. The advisory recommends backing up existing installations before applying the update. No known exploits in the wild have been reported.

Successful exploitation of these vulnerabilities could lead to information disclosure, unauthorized access to resources, privilege escalation, replay attacks on action tokens, and denial of service conditions within environments using the affected Keycloak images. These impacts affect authentication and authorization processes critical to secure identity management in OpenShift deployments.

Red Hat has released updated container images for Keycloak 26.2.15 that address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the updated images is the recommended remediation. There is no indication that these issues are mitigated by default or require additional configuration changes beyond updating to the fixed images.