CLEANSTART-2026-TA42758 Security fixes for ghsa-3p8m-j85q-pgmj, ghsa-45p5-v273-3qqr, ghsa-4cx2-fc23-5wg6, ghsa-9342-92gg-6v29, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-hq9p-pm7w-8p54, ghsa-j288-q9x7-2f5v applied in versions: 26.1.4-r1

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-family-azure, crossplane-provider-aws-firehose, crossplane-provider-aws-kms, crossplane-provider-aws-eks, crossplane-provider-aws-sns, crossplane-provider-aws-rds, crossplane-provider-azure-sql,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-family-azure, crossplane-provider-aws-firehose, crossplane-provider-aws-kms, crossplane-provider-aws-eks, crossplane-provider-aws-sns, crossplane-provider-aws-rds, crossplane-provider-azure-sql,...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: opensearch, sonarqube, thingsboard, zipkin, spark, infinispan, neo4j, flyway, wildfly, apache-pulsar, druid, wavefront-proxy, apicurio-registry, kserve-modelmesh, management-api-for-apache-cassandra-5.0, trino, akhq, keycloak, strimzi-kafka-operator...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: opensearch, sonarqube, thingsboard, zipkin, spark, infinispan, neo4j, flyway, wildfly, apache-pulsar, druid, wavefront-proxy, apicurio-registry, kserve-modelmesh, management-api-for-apache-cassandra-5.0, trino, akhq, keycloak, strimzi-kafka-operator...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: apicurio-registry, knative-kafka-broker-fips, kayenta-fips, grpc-java-fips, wavefront-proxy, commercial-elasticsearch, neo4j, elasticsearch, reposilite, apache-camel-karavan-devmode, keycloak, opensearch, hono, thingsboard, apache-pulsar-fips, trino, kafka-bridge-fip...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: apicurio-registry, knative-kafka-broker-fips, kayenta-fips, grpc-java-fips, wavefront-proxy, commercial-elasticsearch, neo4j, elasticsearch, reposilite, apache-camel-karavan-devmode, keycloak, opensearch, hono, thingsboard, apache-pulsar-fips, trino, kafka-bridge-fip...

GHSA-PWQR-WMGM-9RR8 vulnerabilities

Vulnerabilities for packages: opensearch, sonarqube, thingsboard, zipkin, spark, infinispan, apache-activemq-artemis, flyway, wildfly, tez, logstash, apache-pulsar, druid, wavefront-proxy, apicurio-registry, kserve-modelmesh, management-api-for-apache-cassandra-5.0, trino, akhq, keycloak,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: opensearch, sonarqube, thingsboard, zipkin, spark, infinispan, apache-activemq-artemis, flyway, wildfly, tez, logstash, apache-pulsar, druid, wavefront-proxy, apicurio-registry, kserve-modelmesh, management-api-for-apache-cassandra-5.0, trino, akhq, keycloak,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: apicurio-registry, knative-kafka-broker-fips, kayenta-fips, grpc-java-fips, wavefront-proxy, commercial-elasticsearch, neo4j, elasticsearch, reposilite, apache-camel-karavan-devmode, keycloak, opensearch, hono, tez, thingsboard, apache-pulsar-fips, trino,...

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

GHSA-7XF9-4JFC-WGM4 Keycloak: manage-clients permission escalates to full realm admin access

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.10 <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.10 <=1.4.11) +62 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-model-jpa (>=1.0-alpha-1-12062013 <=26.5.5)

org.keycloak:keycloak-model-jpa MAVEN version =1.0-alpha-1-12062013, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =5.1.0-26.1, =2.5.6-24.0, =0.1.1, =0.1.1-rc3 and more Source cves: CVE-2026-3190 Source advisory:...

EUVD-2026-16309

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

Keycloak: manage-clients permission escalates to full realm admin access

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-3121 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-3121 Source advisory: OSV:GHSA-7XF9-4JFC-WGM4https://vulners.com/osv/OSV:GHSA-7XF9-4JFC-...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-3190 Source advisory: OSV:GHSA-Q35R-VVHV-VX5Hhttps://vulners.com/osv/OSV:GHSA-Q35R-VVHV-...

EUVD-2026-16307

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

GHSA-Q35R-VVHV-VX5H Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

CVE-2026-3121

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...