This advisory covers a comprehensive set of security fixes for Red Hat build of Keycloak 26.6.7 and its Operator on OpenShift. Notable vulnerabilities include CVE-2026-15945 (disclosure of hidden parent groups), CVE-2026-16072 (unauthorized member creation via invitation link exposure), CVE-2026-17526 (privilege escalation via impersonation role), CVE-2026-42211 (remote code execution via prototype pollution), and CVE-2026-79651 (unauthenticated denial of service). Other issues involve bypasses of authorization policies, information disclosure, token validation weaknesses, and incomplete fixes for prior vulnerabilities. The erratum provides new container images to remediate these issues for use within OpenShift Container Platform environments.

The vulnerabilities collectively allow attackers to perform unauthorized actions including privilege escalation to realm administrator accounts, unauthorized creation of members, bypassing of authorization policies, information disclosure of sensitive data such as hidden groups and reCAPTCHA secrets, remote code execution, and denial of service attacks. These impacts can compromise the confidentiality, integrity, and availability of the authentication server and associated applications relying on Keycloak for identity and access management.

Red Hat has released updated container images for Red Hat build of Keycloak 26.6.7 and its Operator that address these vulnerabilities. Users should back up their existing installations and apply the updated images as provided by Red Hat. Since this is an on-premise/private cloud deployment, remediation is managed by applying these official updates. Patch status is confirmed by the vendor advisory. No additional mitigation steps beyond applying the update are specified.