Red Hat Security Advisory: Red Hat build of Keycloak 26.6.7 Security Update
Affects Red Hat keycloakSource GCVE Database
Not known to be exploited · CVSS 4.3 Medium →: upgrade Red Hat keycloak to 26.6.7 when convenient.
Data as of 12 Nov 2026, 23:24 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 26.6.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Network
- The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
- Attack Complexity: Low
- Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
- Privileges Required: Low
- The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
- User Interaction: None
- The vulnerable system can be exploited without any interaction from any user.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: Low
- There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
- Integrity: None
- There is no loss of integrity within the impacted component.
- Availability: None
- There is no impact to availability within the impacted component.
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 16 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponized
- A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Upgrade org.keycloak/keycloak to 26.6.7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.keycloak/keycloakpkg:maven/org.keycloak/keycloakOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A security update to Red Hat build of Keycloak 26.6.7 is available and should be applied to remediate these vulnerabilities. Before updating, users should back up their existing installation including applications, configuration files, and databases. Applying the official update from Red Hat fully addresses the listed security issues.
Description
Red Hat has released a security update for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. These flaws affect authentication, authorization, token handling, and endpoint protections. Users of affected versions prior to 26.6.7 are advised to apply the update to mitigate these risks.
Impact
The vulnerabilities collectively allow attackers to gain unauthorized access, escalate privileges, bypass authorization controls, disclose sensitive information, execute remote code, and cause denial of service. These impacts affect the security of authentication and authorization mechanisms in Keycloak, potentially compromising user and administrative accounts and the integrity of the system.
- CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design · Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Architecture and Design · Implementation
Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-472External Control of Assumed-Immutable Web Parameter (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-212Improper Removal of Sensitive Information Before Storage or Transfer (opens in a new tab)
Base weakness
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Requirements
Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation · Operation · Attack Surface Reduction
Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed.
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1220Insufficient Granularity of Access Control (opens in a new tab)
Base weakness
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity
Architecture and Design · Implementation · Testing
Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.; Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1288Improper Validation of Consistency within Input (opens in a new tab)
Base weakness
The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-401Missing Release of Memory after Effective Lifetime (opens in a new tab)
Variant weaknessLikelihood of exploit: Medium
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Implementation · Libraries or Frameworks
Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Architecture and Design · Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-287Improper Authentication (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-22Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
- Path Traversal (opens in a new tab)
- Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
- Manipulating Web Input to File System Calls (opens in a new tab)
- Using Escaped Slashes in Alternate Encoding (opens in a new tab)
- Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-400Uncontrolled Resource Consumption (opens in a new tab)
Class weaknessLikelihood of exploit: High
The product does not properly control the allocation and maintenance of a limited resource.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place.
Architecture and Design
Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or; uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:68278
- CVE Count
- 28
- Additional Cves
- CVE-2026-16072, CVE-2026-16089, CVE-2026-16093, CVE-2026-16104, CVE-2026-16105, CVE-2026-16106, CVE-2026-16108, CVE-2026-17059, CVE-2026-17526, CVE-2026-17615, CVE-2026-18201, CVE-2026-18209, CVE-2026-18212, CVE-2026-18214, CVE-2026-18215, CVE-2026-18218, CVE-2026-18570, CVE-2026-18571, CVE-2026-18572, CVE-2026-18573, CVE-2026-19607, CVE-2026-19729, CVE-2026-42211, CVE-2026-62243, CVE-2026-74909, CVE-2026-79651, CVE-2026-79652
References
Community reviews
Related threats
- Red Hat Security Advisory: Satellite 6.19.6 Async UpdateCriticalVulnerability
- Red Hat Security Advisory: OpenShift Container Platform 4.13.73 bug fix and security updateHighVulnerability
- Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateHighVulnerability
- Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateHighVulnerability
- Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateCriticalVulnerability