Threats Tagged 'cve-2026-16104'

Red Hat has released security updates for the Red Hat build of Keycloak 26.6.7 and its Operator for OpenShift. These updates address multiple vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service issues. The vulnerabilities affect various components such as group hierarchy search, organization invitation links, JWT assertion policies, role authorization, token exchanges, and more. The update aligns with the standalone Keycloak product release and is intended for on-premise or private cloud deployments on OpenShift Container Platform.

Red Hat has issued a security advisory for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities. These include information disclosure, authorization bypasses, privilege escalation, remote code execution, and denial of service issues. The update fixes a wide range of security flaws affecting authentication, authorization, token handling, and administrative functions. The advisory recommends applying the update after backing up existing installations.

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.