Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Images Update
Red Hat has released updated container images for the Red Hat build of Keycloak 26.4.10 to address multiple security vulnerabilities. These include several authentication bypass issues related to SAML brokers and identity providers, improper validation of encrypted SAML assertions, denial of service via excessive SAMLRequest decompression, and potential security control bypass through authorization header parsing. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.
AI Analysis
Technical Summary
This advisory covers multiple security vulnerabilities in the Red Hat build of Keycloak 26.4.10, an integrated sign-on solution for OpenShift. The vulnerabilities include authentication bypasses due to disabled SAML clients and identity providers (CVE-2026-3047, CVE-2026-3009, CVE-2026-2603), improper validation of encrypted SAML assertions allowing unauthorized access (CVE-2026-2092), missing checks on disabled clients for Docker Registry Protocol (CVE-2026-2733), denial of service from excessive SAMLRequest decompression (CVE-2026-2575), response delays due to unchecked NotOnOrAfter in SubjectConfirmationData (CVE-2026-1190), and potential security control bypass via authorization header parsing (CVE-2026-0707). Red Hat has released new container images for Keycloak 26.4.10 and its operator to address these issues for on-premise or private cloud OpenShift deployments.
Potential Impact
The vulnerabilities collectively allow attackers to bypass authentication controls, potentially gaining unauthorized access to systems relying on Keycloak for identity and access management. Denial of service conditions may also be triggered via crafted SAML requests. These issues affect the integrity and availability of authentication services within affected Keycloak deployments.
Mitigation Recommendations
Red Hat has released updated container images for the Red Hat build of Keycloak 26.4.10 and its operator that address these vulnerabilities. Users should back up their existing installations and apply these updated images as provided by Red Hat. No other mitigation or workaround is specified in the advisory. Patch status is confirmed by the vendor advisory indicating new images are available.
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Images Update
Description
Red Hat has released updated container images for the Red Hat build of Keycloak 26.4.10 to address multiple security vulnerabilities. These include several authentication bypass issues related to SAML brokers and identity providers, improper validation of encrypted SAML assertions, denial of service via excessive SAMLRequest decompression, and potential security control bypass through authorization header parsing. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments.
CVSS v3.1
Score 5.3medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers multiple security vulnerabilities in the Red Hat build of Keycloak 26.4.10, an integrated sign-on solution for OpenShift. The vulnerabilities include authentication bypasses due to disabled SAML clients and identity providers (CVE-2026-3047, CVE-2026-3009, CVE-2026-2603), improper validation of encrypted SAML assertions allowing unauthorized access (CVE-2026-2092), missing checks on disabled clients for Docker Registry Protocol (CVE-2026-2733), denial of service from excessive SAMLRequest decompression (CVE-2026-2575), response delays due to unchecked NotOnOrAfter in SubjectConfirmationData (CVE-2026-1190), and potential security control bypass via authorization header parsing (CVE-2026-0707). Red Hat has released new container images for Keycloak 26.4.10 and its operator to address these issues for on-premise or private cloud OpenShift deployments.
Potential Impact
The vulnerabilities collectively allow attackers to bypass authentication controls, potentially gaining unauthorized access to systems relying on Keycloak for identity and access management. Denial of service conditions may also be triggered via crafted SAML requests. These issues affect the integrity and availability of authentication services within affected Keycloak deployments.
Mitigation Recommendations
Red Hat has released updated container images for the Red Hat build of Keycloak 26.4.10 and its operator that address these vulnerabilities. Users should back up their existing installations and apply these updated images as provided by Red Hat. No other mitigation or workaround is specified in the advisory. Patch status is confirmed by the vendor advisory indicating new images are available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3948
- Cve Count
- 8
- Additional Cves
- ["CVE-2026-1190","CVE-2026-2092","CVE-2026-2575","CVE-2026-2603","CVE-2026-2733","CVE-2026-3009","CVE-2026-3047"]
- Cvss Version
- 3.1
Threat ID: 6a273212e29bf47b509c07fd
Added to database: 06/08/2026, 21:20:18 UTC
Last enriched: 06/27/2026, 23:44:44 UTC
Last updated: 07/31/2026, 19:24:50 UTC
Views: 233
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.