Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update

The Red Hat build of Keycloak 26.6.6, a standalone authentication and single sign-on server, contains several critical security vulnerabilities. These include CVE-2026-9796, a Time-of-Check to Time-of-Use (TOCTOU) privilege escalation vulnerability; CVE-2026-18963, an unauthenticated account takeover via reset-credentials flow bypass; CVE-2026-17048, leakage of vault-resolved rotated client secrets via the Admin REST API; CVE-2026-15571, predictable account-linking hashes enabling account takeover via malicious OIDC clients; and CVE-2026-14613, disclosure of hidden group metadata without proper group view permissions. Red Hat has released updated packages to address these issues.

Successful exploitation of these vulnerabilities could allow attackers to escalate privileges, take over user accounts without authentication, leak sensitive client secrets, and access hidden group metadata without authorization. This compromises the confidentiality, integrity, and availability of authentication services provided by Keycloak, potentially impacting all applications relying on it for identity management.

Red Hat has released updated packages for the Red Hat build of Keycloak 26.6.6 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update from Red Hat is the recommended remediation. No alternative mitigations or workarounds are indicated in the advisory.