Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.4 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.4 and Red Hat build of Keycloak 26.6.4 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

com.kleegroup.accelerator:accelerator-message-keycloakbrevo (>=1.0.1, <=1.0.2), com.kleegroup.accelerator:accelerator-security-keycloakmfa (1.0.1) +17 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (24.0.3)

org.keycloak:keycloak-services MAVEN version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.kleegroup.accelerator:accelerator-message-keycloakbrevo =1.0.1, =1.4.7, =1.4.8 -...

de.adorsys.sts:keycloak-storage-provider (>=1.2.0, <=1.2.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (>=6.5, <=6.9) +23 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (25.0.2)

org.keycloak:keycloak-services MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.2.0, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5,...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.5), com.github.vzakharchenko:cisco-radius-plugin (1.4.5) +32 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (18.0.1)

org.keycloak:keycloak-services MAVEN version 18.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.5 -...

net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (2.0), net.optionfactory.keycloak:optionfactory-keycloak-email-sender (2.0) +17 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (20.0.0)

org.keycloak:keycloak-services MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider 2.0 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.5), io.phasetwo.keycloak:keycloak-magic-link (0.15) +14 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (21.1.2)

org.keycloak:keycloak-services MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.5 - io.phasetwo.keycloak:keycloak-magic-link 0.15 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.8), io.phasetwo.keycloak:keycloak-extensions (0.1) +24 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (22.0.3)

org.keycloak:keycloak-services MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.8 - io.phasetwo.keycloak:keycloak-extensions 0.1 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.7), com.github.vzakharchenko:cisco-radius-plugin (1.3.7) +23 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (13.0.1)

org.keycloak:keycloak-services MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.7 -...

io.github.kilmajster:keycloak-username-password-attribute-authenticator (0.2.0), org.keycloak:authenticator-required-action-example (15.1.1) +17 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (15.1.1)

org.keycloak:keycloak-services MAVEN version 15.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.kilmajster:keycloak-username-password-attribute-authenticator 0.2.0 -...

org.keycloak:keycloak-dependencies-server-min (4.7.0.final), org.keycloak:keycloak-model-jpa (4.7.0.final) +2 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (4.7.0.final)

org.keycloak:keycloak-services MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.7.0.final - org.keycloak:keycloak-model-jpa...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

org.keycloak:keycloak-authz-policy-drools (2.3.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.3.0.cr1) +5 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (2.3.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.3.0.cr1 -...

fr.cnieg.keycloak:attribute-login-provider (1.4.1), org.keycloak:keycloak-crypto-fips1402 (23.0.5) +13 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (23.0.5)

org.keycloak:keycloak-services MAVEN version 23.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.1 - org.keycloak:keycloak-crypto-fips1402 23.0.5 -...

org.keycloak:keycloak-account-freemarker (1.0.3.final), org.keycloak:keycloak-dependencies-server-all (1.0.3.final) +3 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.0.3.final)

org.keycloak:keycloak-services MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.3.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.1.0-beta.2), org.keycloak:keycloak-account-freemarker (1.2.0.final) +9 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.2.0.final)

org.keycloak:keycloak-services MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.1.0-beta.2 -...

org.keycloak:keycloak-account-freemarker (1.8.0.cr2), org.keycloak:keycloak-broker-oidc (1.8.0.cr2) +9 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.8.0.cr2)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr2 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

org.keycloak:keycloak-forms (1.0-alpha-1) potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.0-alpha-1)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-forms 1.0-alpha-1 Source cves: CVE-2026-9087 Source advisory:...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-account-freemarker (1.0-beta-4) +3 more potentially affected by CVE-2026-9087 via org.keycloak:keycloak-services (1.0-beta-4)

org.keycloak:keycloak-services MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...