Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.4 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.4 and Red Hat build of Keycloak 26.6.4 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

CVE-2026-4874 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

org.keycloak:keycloak-account-freemarker (1.2.0.beta1), org.keycloak:keycloak-broker-oidc (1.2.0.beta1) +4 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (1.2.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-authz-policy-drools (3.3.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.3.0.cr1) +6 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (3.3.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.3.0.cr1 -...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-4874 Source advisory: GHSA-22RM-WP4X-V5CX...

org.keycloak:keycloak-dependencies-server-min (4.8.2.final), org.keycloak:keycloak-model-jpa (4.8.2.final) +2 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (4.8.2.final)

org.keycloak:keycloak-services MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.2.final - org.keycloak:keycloak-model-jpa...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.0, <=1.4.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.0, <=1.4.2) +26 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (17.0.0)

org.keycloak:keycloak-services MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.16), com.github.vzakharchenko:cisco-radius-plugin (1.3.16) +24 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (16.0.0)

org.keycloak:keycloak-services MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.16 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.19), com.github.vzakharchenko:cisco-radius-plugin (1.3.19) +28 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (16.1.1)

org.keycloak:keycloak-services MAVEN version 16.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.19 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +23 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (14.0.0)

org.keycloak:keycloak-services MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.11), com.github.vzakharchenko:cisco-radius-plugin (1.3.11) +25 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (15.0.1)

org.keycloak:keycloak-services MAVEN version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.11 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.12, <=1.3.14), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.12, <=1.3.14) +29 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (15.0.2)

org.keycloak:keycloak-services MAVEN version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.12, =1.3.12, =1.3.12, =1.3.12, =1.3.12,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.15), com.github.vzakharchenko:cisco-radius-plugin (1.3.15) +24 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (15.1.0)

org.keycloak:keycloak-services MAVEN version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.15 -...

com.charlyghislain.keycloak:keycloak-importexport (21.0.0), de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.10.1-21.0.1, <=0.10.8-21.0.1) +34 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (21.0.1)

org.keycloak:keycloak-services MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 21.0.0 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.4), io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27) +25 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (21.0.2)

org.keycloak:keycloak-services MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.4 - io.phasetwo.keycloak:keycloak-orgs =0.24, =2.5,...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.8.3-20.0.5, <=0.10.0-20.0.5), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=0.8.3-20.0.5, <=0.10.0-20.0.5) +14 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (20.0.5)

org.keycloak:keycloak-services MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.8.3-20.0.5, =0.8.3-20.0.5, =0.10.0-20.0.5 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.10), com.github.vzakharchenko:cisco-radius-plugin (1.3.10) +22 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (15.0.0)

org.keycloak:keycloak-services MAVEN version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.10 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.6), com.github.vzakharchenko:cisco-radius-plugin (1.3.6) +27 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (13.0.0)

org.keycloak:keycloak-services MAVEN version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.6 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.7), org.keycloak:keycloak-crypto-fips1402 (22.0.2) +13 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (22.0.2)

org.keycloak:keycloak-services MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.7 - org.keycloak:keycloak-crypto-fips1402 22.0.2 -...

io.phasetwo.keycloak:keycloak-events (>=0.18, <=0.19), io.phasetwo.keycloak:keycloak-magic-link (>=0.16, <=0.19) +18 more potentially affected by CVE-2026-4874 via org.keycloak:keycloak-services (22.0.0)

org.keycloak:keycloak-services MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.phasetwo.keycloak:keycloak-events =0.18, =0.16, =0.37, =0.9, =1.6, =2.1 -...