Threats Tagged 'cve-2026-54513'

Red Hat has issued a security advisory for Red Hat build of Keycloak 26.4.14 addressing multiple vulnerabilities including privilege escalation, authorization bypasses, arbitrary code execution, denial of service, and bypasses of security restrictions. These vulnerabilities affect various components such as the Admin UI, FGAPv2, DCR protocol, LDAP user search, SAML broker, and OIDC redirect URI processing. The advisory covers 17 distinct CVEs with high severity impacts. No explicit patch or fix details are provided in the advisory content.

Red Hat has issued a security advisory for the Red Hat build of Keycloak 26.6.5 addressing multiple vulnerabilities. These include authorization bypasses, privilege escalation, denial of service, arbitrary code execution, and security bypasses affecting various components such as admin UI extensions, FGAPv2, DCR policies, LDAP user searches, Quarkus REST, SAML broker, gRPC, HTTP requests, and OIDC redirect URI handling. The advisory covers 19 distinct CVEs with high severity. No explicit patch links are provided in the advisory, but updated packages are available from Red Hat's Customer Portal.

CVE-2026-54513 is a high-severity vulnerability in the jackson-databind library affecting versions from 2.10.0 up to but not including 2.18.8, 2.19.0 up to but not including 2.21.4, and 3.0.0 up to but not including 3.1.4. The flaw lies in the BasicPolymorphicTypeValidator's allowIfSubTypeIsArray() method, which incorrectly allows any array type without validating the component type against the allowlist. This bypass enables attackers to instantiate non-allowlisted types via array wrappers, potentially leading to arbitrary code execution. Red Hat has issued patches and recommends upgrading to fixed versions or removing the vulnerable configuration. No known exploits in the wild have been reported.

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.