This advisory covers multiple security fixes in Red Hat's build of Keycloak 26.0.6, a standalone server providing authentication and single sign-on. The vulnerabilities addressed include: CVE-2024-9666, a denial-of-service vulnerability triggered by proxy header handling; CVE-2024-10039, a TLS passthrough issue; CVE-2024-10270, a general denial-of-service vulnerability; CVE-2024-10451, sensitive data exposure during the build process; and CVE-2024-10492, a path traversal vulnerability. The advisory indicates these issues have been fixed in the updated packages available from Red Hat's Customer Portal. No known exploits in the wild have been reported. The vendor recommends applying this update after installing all previously released relevant errata.

The vulnerabilities collectively could allow denial-of-service conditions, unauthorized access to sensitive data during the build process, and path traversal attacks potentially leading to unauthorized file access. These issues affect the security and availability of the Keycloak authentication server, which is critical for managing authentication and single sign-on for web and mobile applications. Exploitation could disrupt authentication services or expose sensitive information.

Red Hat has released updated packages for the build of Keycloak 26.0.6 that address these vulnerabilities. Users should apply this update promptly after ensuring all previously released relevant errata are installed. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as an official fix available from Red Hat's Customer Portal.