Threats Tagged 'cve-2026-18201'

Red Hat has released security updates for the Red Hat build of Keycloak 26.6.7 and its Operator for OpenShift. These updates address multiple vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service issues. The vulnerabilities affect various components such as group hierarchy search, organization invitation links, JWT assertion policies, role authorization, token exchanges, and more. The update aligns with the standalone Keycloak product release and is intended for on-premise or private cloud deployments on OpenShift Container Platform.

Red Hat has issued a security advisory for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities. These include information disclosure, authorization bypasses, privilege escalation, remote code execution, and denial of service issues. The update fixes a wide range of security flaws affecting authentication, authorization, token handling, and administrative functions. The advisory recommends applying the update after backing up existing installations.

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations.