Red Hat has released updated container images for the Red Hat build of Keycloak 26.2.9 and its Operator for OpenShift to address three security vulnerabilities. CVE-2025-9162 involves variable injection into environment variables, which could lead to unintended environment manipulation. CVE-2025-10043 is an incomplete fix of a previous vulnerability (CVE-2024-10492), indicating residual risk from the earlier issue. CVE-2025-10044 concerns injection of error_description content on error pages, potentially enabling injection attacks such as cross-site scripting. These issues affect the authentication server functionality provided by Keycloak within OpenShift Container Platform. The advisory recommends updating to the new images to mitigate these vulnerabilities.

The vulnerabilities allow injection attacks that could compromise environment variables or inject malicious content into error pages, potentially impacting authentication flows and user session management. This could lead to unauthorized manipulation of authentication behavior or exposure of sensitive information via error messages. The incomplete fix of a prior vulnerability suggests that some risk remained until this update. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated container images for Keycloak 26.2.9 and its Operator that address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Deploying the updated images is the recommended remediation. No alternative mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory indicating new images are available.