CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-94000: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-93999: Missing Authorization

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Un escáner de vulnerabilidades no intrusivo, basado en versiones, para CVE-2026-4282 , que afecta a Keycloak y a Red Hat Build of Keycloak RHBK. ⚠️ Descargo de responsabilidad: Esta herramienta está pensada estrictamente para investigación de seguridad autorizada, pruebas de...

CLEANSTART-2026-DA27362 Security fix for ghsa-fghv-69vj-qj49 applied in: cloudwatch-exporter 0.16.0-r0, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1, keycloak 26.1.4-r1, keycloak 26.2.12-r0, kogito-apps 10.1.0-r0, kserve-modelmesh 0.12.0-r16, management-api-for-apache-cassandra-5.0 0.1.107-r0, management-api-for-apache-cassandra-5.0 0.1.108-r0, management-api-for-apache-cassandra-5.0 0.1.109-r0, stargate 1.0.90-r4, stargate 2.0.44-r4

ghsa-fghv-69vj-qj49 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LB17279 Security fix for ghsa-4cx2-fc23-5wg6 applied in: keycloak 26.1.4-r1, kserve-modelmesh 0.12.0-r16, logstash-fips 9.0.8-r3, orientdb 3.2.38-r0

ghsa-4cx2-fc23-5wg6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LI24140 Security fix for ghsa-9342-92gg-6v29 applied in: keycloak 26.1.4-r1, keycloak 26.2.12-r0, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2

ghsa-9342-92gg-6v29 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XW89737 Security fix for ghsa-hq9p-pm7w-8p54 applied in: keycloak 26.1.4-r1, keycloak 26.2.12-r0, kogito-apps 10.1.0-r0

ghsa-hq9p-pm7w-8p54 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LY97922 Security fix for ghsa-45p5-v273-3qqr applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.1.4-r1, keycloak 26.2.12-r0, keycloak 26.5.0-r0, keycloak 26.5.0-r2, keycloak 26.5.7-r0, kogito-apps 10.1.0-r0

ghsa-45p5-v273-3qqr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HQ10523 Security fix for ghsa-h5fg-jpgr-rv9c applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.1.4-r1, keycloak 26.2.12-r0, keycloak 26.5.0-r0, keycloak 26.5.0-r2, keycloak 26.5.7-r0, kogito-apps 10.1.0-r0

ghsa-h5fg-jpgr-rv9c affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VG40041 Security fix for ghsa-5rfx-cp42-p624 applied in: keycloak 26.4.7-r3, keycloak 26.5.0-r0, keycloak 26.5.0-r2, kogito-apps 10.1.0-r0

ghsa-5rfx-cp42-p624 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IW40503 Security fix for CVE-2017-12158 applied in: keycloak 26.5.0-r0, keycloak 26.5.0-r2

CVE-2017-12158 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XS62872 Security fix for CVE-2017-12159 applied in: keycloak 26.5.0-r0, keycloak 26.5.0-r2

CVE-2017-12159 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZX15129 Security fix for ghsa-cphf-4846-3xx9 applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.4.7-r3, keycloak 26.5.6-r5, kogito-apps 10.1.0-r0, spark-sc213-jdk17-py311 4.1.1-r2, strimzi-kafka-operator 0.50.0-r0

ghsa-cphf-4846-3xx9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AL62330 Security fix for CVE-2025-11966 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0

CVE-2025-11966 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WF23391 Security fix for CVE-2025-11965 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.4.7-r5, keycloak 26.5.7-r4, kogito-apps 10.1.0-r0

CVE-2025-11965 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EK29154 Security fix for CVE-2026-1002 applied in: apicurio-registry 3.1.7-r6, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.4.7-r3, keycloak 26.5.6-r5, kogito-apps 10.1.0-r0, spark-sc213-jdk17-py311 4.1.1-r2, strimzi-kafka-operator 0.46.1-r3, strimzi-kafka-operator 0.47.0-r2, strimzi-kafka-operator 0.48.0-r1, strimzi-kafka-operator 0.49.1-r0

CVE-2026-1002 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZC26569 Security fix for CVE-2025-59250 applied in: apache-hive 4.0.1-r8, apache-hive 4.1.0-r5, apicurio-registry 3.1.7-r6, keycloak 26.3.5-r3, keycloak 26.4.11-r2, keycloak 26.5.7-r0, keycloak 26.6.1-r1, keycloak 26.6.3-r3, sonarqube 25.12.0.117093-r2, sonarqube 26.3.0.120487-r3

CVE-2025-59250 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PA41665 Security fix for CVE-2025-66560 applied in: keycloak 26.3.5-r3, keycloak 26.5.7-r5, kogito-apps 10.1.0-r0

CVE-2025-66560 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EW06968 Security fix for CVE-2026-33871 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, apache-nifi 2.7.2-r2, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kogito-apps 10.1.0-r1, kserve-modelmesh 0.10.0-r0, kserve-modelmesh 0.12.0-r0, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2, stargate 1.0.91-r0, stargate 2.0.44-r6, stargate 2.0.48-r0, strimzi-kafka-operator 0.50.1-r1, strimzi-kafka-operator 0.51.0-r1, thingsboard 4.3.0.1-r2, thingsboard 4.3.1-r1, thingsboard 4.3.1.1-r0, trino 480-r3, wavefront-proxy 13.9-r1, wildfly 39.0.1-r0

CVE-2026-33871 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...