This advisory covers security fixes in Red Hat build of Keycloak 26.0.15 container images and the associated Operator for OpenShift. The vulnerabilities addressed include CVE-2025-9162, involving variable injection into environment variables, and CVE-2025-8419, an SMTP injection vulnerability. These issues could potentially allow injection attacks impacting the authentication server functionality. The update consists of new container images that align with the standalone Keycloak 26.0.15 release, intended for deployment on OpenShift Container Platform. No CVSS scores are provided, and no known exploits in the wild have been reported.

The vulnerabilities could allow an attacker to perform injection attacks via environment variables or SMTP injection, potentially compromising the authentication server's integrity or behavior. This could affect user authentication and account management services provided by Keycloak in OpenShift environments. However, the advisory classifies the severity as moderate and does not report any known active exploitation.

Red Hat has released updated container images for Keycloak 26.0.15 and its Operator that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Since this is not a cloud service, remediation requires deploying the updated images. Patch status is confirmed by the vendor advisory indicating new images are available. No additional mitigation steps are specified or required beyond applying the updated images.