This advisory covers a set of security vulnerabilities in Red Hat's build of Keycloak 26.4.10, an integrated sign-on solution deployed as a containerized image on OpenShift. The vulnerabilities include authentication bypasses due to disabled SAML clients or identity providers (CVE-2026-3047, CVE-2026-3009, CVE-2026-2603), improper validation of encrypted SAML assertions (CVE-2026-2092), missing checks on disabled clients for Docker Registry protocol (CVE-2026-2733), denial of service via excessive SAMLRequest decompression (CVE-2026-2575), response delays from unchecked NotOnOrAfter timestamps in SAML SubjectConfirmationData (CVE-2026-1190), and potential security control bypass through authorization header parsing (CVE-2026-0707). Red Hat has released new container images that address these issues for on-premise or private cloud OpenShift deployments.

The vulnerabilities collectively could allow attackers to bypass authentication mechanisms, gain unauthorized access, cause denial of service conditions, or bypass security controls within Keycloak deployments. This impacts the integrity and availability of authentication services managed by Keycloak in OpenShift environments. No known exploits in the wild have been reported at this time.

Red Hat has released updated container images for Red Hat build of Keycloak 26.4.10 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the updated images is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the update.