Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Images Security Update

Red Hat build of Keycloak 26.6.6 images for OpenShift contain several critical security flaws: CVE-2026-9796 is a privilege escalation vulnerability due to a Time-of-Check to Time-of-Use (TOCTOU) race condition; CVE-2026-18963 allows unauthenticated account takeover via reset-credentials flow bypass; CVE-2026-17048 leaks vault-resolved rotated client secrets through the Admin REST API; CVE-2026-15571 involves predictable account-linking hashes that enable account takeover via malicious OIDC clients; and CVE-2026-14613 discloses hidden group metadata without proper group view permissions. These vulnerabilities affect the Red Hat build of Keycloak 26.6.6 and its operator images deployed on OpenShift Container Platform. Red Hat has released new images to fix these issues aligning with the standalone product release.

Successful exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive group metadata, account takeover by malicious clients or unauthenticated attackers, leakage of client secrets, and privilege escalation within the Keycloak authentication server environment. This could compromise authentication integrity and user account security in applications relying on Keycloak for identity management.

Red Hat has released updated container images for Red Hat build of Keycloak 26.6.6 and its operator to address these security issues. Users should back up existing installations and apply the updated images as provided by Red Hat. No additional mitigation steps are indicated beyond applying the official update.