This security advisory from Red Hat addresses several vulnerabilities in the Red Hat build of Keycloak 26.4.16 images for OpenShift. Notable issues include CVE-2026-17526, a privilege escalation vulnerability allowing takeover of realm administrator accounts via impersonation roles; CVE-2026-18212, where SAML Redirect DEFLATE helpers leak native zlib state; CVE-2026-19607, a broker-originated username collision causing account lockout; CVE-2026-19729, an incomplete fix for arbitrary filesystem path probing via keystore parameters; CVE-2026-62243, a TLS hostname verification bypass due to OpenSSL client path misconfiguration; CVE-2026-74909, an incomplete fix allowing policy enforcer bypass via percent-encoded URI segments; and CVE-2026-79651, an unauthenticated denial-of-service via unbounded locale caching. The advisory releases new container images with these security fixes for on-premise or private cloud deployments. No exploits in the wild are currently known.

The vulnerabilities collectively could allow attackers to escalate privileges to realm administrator levels, leak sensitive information, cause account lockouts, bypass security policies, circumvent TLS hostname verification, and cause denial-of-service conditions without authentication. These impacts affect the security and availability of authentication services managed by Keycloak in OpenShift environments.

Red Hat has released updated container images for Keycloak 26.4.16 that address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the updated images is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.