The Red Hat build of Keycloak 26.2.8 images for OpenShift contain two security vulnerabilities: CVE-2025-9162, involving variable injection into environment variables, and CVE-2025-8419, an SMTP injection vulnerability within Keycloak. These issues could potentially allow injection attacks affecting authentication or email functionality. Red Hat has released updated container images to address these vulnerabilities, aligning with the standalone Keycloak 26.2.8 release. The advisory does not provide CVSS scores or detailed exploitation methods but categorizes the severity as moderate. No known exploits have been reported in the wild. The update is intended for on-premise or private cloud deployments using OpenShift Container Platform.

The vulnerabilities could allow attackers to perform injection attacks via environment variables or SMTP functionality within the Keycloak authentication server, potentially compromising authentication flows or email-related operations. The exact impact scope is not detailed, but the issues are considered moderate in severity. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated Keycloak 26.2.8 container images that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the updated images is the recommended remediation. Patch status is confirmed by the vendor advisory indicating new images are available. No additional mitigation steps are specified or required beyond applying the update.