The Red Hat build of Keycloak 26.4.16, a standalone server for authentication and single sign-on, contains several security vulnerabilities. Notably, CVE-2026-17526 allows privilege escalation through impersonation roles enabling takeover of realm administrator accounts. Other issues include leakage of native zlib state during SAML Redirect DEFLATE processing (CVE-2026-18212), account lockout caused by broker-originated username collisions (CVE-2026-19607), incomplete fixes for arbitrary filesystem path probing via keystore parameters (CVE-2026-19729), TLS hostname verification bypass due to OpenSSL client misconfiguration (CVE-2026-62243), incomplete fix allowing policy enforcer bypass via percent-encoded URI segments (CVE-2026-74909), and an unauthenticated denial-of-service via unbounded locale caching (CVE-2026-79651). These vulnerabilities collectively impact the security and reliability of authentication services provided by Keycloak.

Successful exploitation of these vulnerabilities could allow attackers to escalate privileges to realm administrator level, leak sensitive internal state information, cause account lockouts, bypass security policies, circumvent TLS hostname verification, and cause denial-of-service conditions without authentication. This compromises the integrity, confidentiality, and availability of authentication services managed by Keycloak.

Red Hat has issued an important security update for Keycloak 26.4.16 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the official Red Hat update is the recommended remediation. Patch status is confirmed as available via the Red Hat advisory RHSA-2026:68280.