Red Hat Red Hat build of Keycloak 26.4.16
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-19607 | | Keycloak-services: keycloak-services: broker-originated username collision causes account lockout | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-17526 | | Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts | HIGH 7.2 | 0.6 % | ||
| CVE-2026-79651 | | Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching | HIGH 7.5 | 0.8 % | ||
| CVE-2026-74909 | | Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments | HIGH 8.1 | 0.8 % | ||
| CVE-2026-18212 | | Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state | HIGH 7.5 | 0.7 % | ||
| CVE-2026-19729 | | Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters | MEDIUM 4.9 | 0.6 % |