This security advisory from Red Hat addresses several vulnerabilities in the Red Hat build of Keycloak 26.0.6, an integrated sign-on solution deployed as a containerized image on OpenShift. Key issues fixed include a denial-of-service vulnerability caused by improper proxy header handling (CVE-2024-9666), sensitive data exposure in the build process (CVE-2024-10451), path traversal (CVE-2024-10492), TLS passthrough issues (CVE-2024-10039), and another denial-of-service vulnerability (CVE-2024-10270). The advisory provides updated container images and an operator update for managing Keycloak clusters. These fixes are important for on-premise or private cloud deployments using OpenShift Container Platform.

The vulnerabilities addressed could allow denial-of-service conditions, unauthorized access to sensitive data during the build process, path traversal attacks, and issues with TLS passthrough, potentially impacting the confidentiality, integrity, and availability of the Keycloak authentication service. Exploitation could disrupt authentication services or expose sensitive information. However, there are no reports of active exploitation in the wild at the time of this advisory.

Red Hat has released updated container images for Keycloak 26.0.6 and its operator to remediate these vulnerabilities. Users should apply this update after ensuring all previously released relevant errata have been applied. Detailed update instructions are available in the Red Hat advisory. No additional mitigation steps are indicated beyond applying the official update.