This advisory addresses two vulnerabilities in the Red Hat build of Keycloak 26.0.8 for OpenShift. CVE-2024-11734 is a denial of service vulnerability triggered via security headers in the Keycloak server component. CVE-2024-11736 allows an administrator unrestricted access to system and environment variables, which could lead to unauthorized system configuration changes. Red Hat has released updated container images aligned with the standalone Keycloak 26.0.8 release to remediate these issues. The advisory applies to containerized deployments on OpenShift Container Platform and includes updates to the Keycloak Operator to simplify cluster management.

The denial of service vulnerability (CVE-2024-11734) could disrupt authentication services by exploiting security headers, potentially causing service unavailability. The unrestricted admin use of system and environment variables (CVE-2024-11736) could allow an administrator to manipulate system settings beyond intended limits, potentially compromising system integrity or stability. Both vulnerabilities affect the authentication server functionality critical for centralized login and user management in web, mobile, and RESTful applications deployed via OpenShift. No known exploits in the wild have been reported at this time.

Red Hat has released updated container images for the Red Hat build of Keycloak 26.0.8 and its Operator to address these vulnerabilities. Users should apply these updated images as provided by Red Hat. Before applying this update, ensure all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. Since this is not a cloud service, remediation requires user action to deploy the updated images. No alternative mitigations or workarounds are specified in the advisory.