Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update
Red Hat has issued a critical security update for its build of Keycloak 26.6.6, addressing multiple vulnerabilities. These include unauthorized disclosure of hidden group metadata, predictable account-linking hashes enabling account takeover, leakage of rotated client secrets via the Admin REST API, unauthenticated account takeover through reset-credentials flow bypass, and a privilege escalation vulnerability due to a Time-of-Check to Time-of-Use (TOCTOU) flaw. The update is intended to fix these issues and improve the security of authentication and single sign-on capabilities provided by Keycloak.
AI Analysis
Technical Summary
The Red Hat build of Keycloak 26.6.6 addresses five critical security vulnerabilities: CVE-2026-14613 involves disclosure of hidden group metadata without proper permissions; CVE-2026-15571 allows account takeover via predictable account-linking hashes exploited by malicious OIDC clients; CVE-2026-17048 leaks vault-resolved rotated client secrets through the Admin REST API; CVE-2026-18963 enables unauthenticated account takeover by bypassing the reset-credentials flow; and CVE-2026-9796 is a privilege escalation vulnerability caused by a TOCTOU race condition. These vulnerabilities affect the authentication and authorization mechanisms of Keycloak, potentially allowing attackers to gain unauthorized access or escalate privileges.
Potential Impact
Successful exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive group metadata, account takeover by malicious clients, leakage of client secrets, unauthenticated account takeover, and privilege escalation. This compromises the confidentiality, integrity, and availability of authentication services and potentially the applications relying on Keycloak for single sign-on.
Mitigation Recommendations
Red Hat has released updated packages for the Red Hat build of Keycloak 26.6.6 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update from Red Hat is the recommended remediation. Patch status is confirmed by the vendor advisory, indicating an official fix is available.
Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update
Description
Red Hat has issued a critical security update for its build of Keycloak 26.6.6, addressing multiple vulnerabilities. These include unauthorized disclosure of hidden group metadata, predictable account-linking hashes enabling account takeover, leakage of rotated client secrets via the Admin REST API, unauthenticated account takeover through reset-credentials flow bypass, and a privilege escalation vulnerability due to a Time-of-Check to Time-of-Use (TOCTOU) flaw. The update is intended to fix these issues and improve the security of authentication and single sign-on capabilities provided by Keycloak.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat build of Keycloak 26.6.6 addresses five critical security vulnerabilities: CVE-2026-14613 involves disclosure of hidden group metadata without proper permissions; CVE-2026-15571 allows account takeover via predictable account-linking hashes exploited by malicious OIDC clients; CVE-2026-17048 leaks vault-resolved rotated client secrets through the Admin REST API; CVE-2026-18963 enables unauthenticated account takeover by bypassing the reset-credentials flow; and CVE-2026-9796 is a privilege escalation vulnerability caused by a TOCTOU race condition. These vulnerabilities affect the authentication and authorization mechanisms of Keycloak, potentially allowing attackers to gain unauthorized access or escalate privileges.
Potential Impact
Successful exploitation of these vulnerabilities could lead to unauthorized disclosure of sensitive group metadata, account takeover by malicious clients, leakage of client secrets, unauthenticated account takeover, and privilege escalation. This compromises the confidentiality, integrity, and availability of authentication services and potentially the applications relying on Keycloak for single sign-on.
Mitigation Recommendations
Red Hat has released updated packages for the Red Hat build of Keycloak 26.6.6 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update from Red Hat is the recommended remediation. Patch status is confirmed by the vendor advisory, indicating an official fix is available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:56523
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-14613","CVE-2026-15571","CVE-2026-17048","CVE-2026-18963"]
- Cvss Version
- null
Threat ID: 6a870a71acd9273b49b589fd
Added to database: 08/20/2026, 14:08:49 UTC
Last enriched: 08/20/2026, 14:28:23 UTC
Last updated: 08/21/2026, 01:51:58 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.