The Red Hat build of Keycloak 26.2.9 addresses three security vulnerabilities: CVE-2025-9162 involves variable injection into environment variables, CVE-2025-10043 is an incomplete fix of a prior vulnerability CVE-2024-10492, and CVE-2025-10044 concerns injection of error_description on error pages. These vulnerabilities relate to injection weaknesses (CWE-526 and CWE-79) that could impact the integrity of environment variables and error handling in the Keycloak authentication server. The advisory from Red Hat (RHSA-2025:16399) recommends updating to the new 26.2.9 build to remediate these issues. The advisory does not provide explicit patch version ranges or detailed technical exploitation information. No evidence of active exploitation is reported.

The vulnerabilities could allow injection attacks affecting environment variables and error page content, potentially leading to unintended behavior or information disclosure within the Keycloak authentication server. The incomplete fix of a previous vulnerability indicates that prior mitigations were insufficient, necessitating this update. However, no known exploits in the wild have been reported, and the severity is classified as moderate by Red Hat.

Red Hat recommends updating to the Red Hat build of Keycloak version 26.2.9 to address these vulnerabilities. Before applying the update, back up all existing installations, including applications, configuration files, and databases. Since the advisory does not provide explicit patch links or fixed version ranges, users should obtain the update directly from the Red Hat Customer Portal. No alternative mitigations or workarounds are specified.