Threats Tagged 'cve-2026-1180'
View all threats tagged with 'cve-2026-1180'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-1180'
Click on any threat for detailed analysis and mitigation recommendations
Red Hat has released updated images for the Red Hat build of Keycloak 26.4.11 addressing multiple security vulnerabilities. These include improper access control issues, information disclosure, privilege escalation, server-side request forgery (SSRF), denial of service, and token replay vulnerabilities affecting the Keycloak Admin REST API, Operator, and related components. The update aligns with the standalone Keycloak product release and is intended for use within OpenShift Container Platform deployments. Join the discussion | GCVE Database | 04/02/2026, 13:58:01 UTC Added: 06/24/2026, 16:59:26 UTC |
Red Hat has released an important security advisory for Red Hat build of Keycloak 26.4.11 addressing multiple vulnerabilities including improper access control, information disclosure, privilege escalation, server-side request forgery, denial of service, and token replay issues. These vulnerabilities affect the Admin REST API, UMA 2.0 Protection API, account management endpoints, and other components. The update aims to fix these security issues to protect authentication and single sign-on capabilities provided by Keycloak. Join the discussion | GCVE Database | 04/02/2026, 13:54:47 UTC Added: 06/24/2026, 16:59:27 UTC |
0 A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbitrary jwks_uri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources. As a result, attackers can probe internal services and cloud metadata endpoints, creating an information disclosure and reconnaissance risk. Join the discussion | CVE Database V5 | 01/20/2026, 12:33:00 UTC Added: 01/20/2026, 13:05:56 UTC |
Showing 1 to 3 of 3 results