This advisory covers multiple critical security vulnerabilities in Red Hat build of Keycloak 26.6.6 for OpenShift. The vulnerabilities include: CVE-2026-14613, where the FGAP v2 role groups endpoint discloses hidden group metadata without proper permissions; CVE-2026-15571, a predictable account-linking hash enabling account takeover via a malicious OIDC client; CVE-2026-17048, leakage of vault-resolved rotated client secrets through the Admin REST API; CVE-2026-18963, an unauthenticated account takeover via reset-credentials flow bypass; and CVE-2026-9796, a privilege escalation due to a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. These vulnerabilities impact the authentication and authorization mechanisms of Keycloak in OpenShift containerized environments. The advisory releases new container images to address these issues.

The vulnerabilities collectively allow unauthorized disclosure of sensitive metadata and secrets, account takeover including unauthenticated takeover, and privilege escalation. This compromises the confidentiality, integrity, and availability of authentication and user management services within OpenShift deployments using Red Hat build of Keycloak 26.6.6. Exploitation could lead to unauthorized access to protected resources and administrative functions.

Red Hat has released updated container images for Red Hat build of Keycloak 26.6.6 and the Keycloak Operator that address these vulnerabilities. Users should back up their existing installations and apply the updated images as provided in the advisory RHSA-2026:56524. No alternative mitigations are indicated; applying the update is the recommended remediation.