CLEANSTART-2026-WD74020 Security fixes in keycloak 26.6.4-r1

Package keycloak version 26.6.4-r1 fixes 14 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-ZA01366 Security fixes in crossplane-provider-keycloak 2.22.1-r2

Package crossplane-provider-keycloak version 2.22.1-r2 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-5160...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-40984 vulnerabilities

Vulnerabilities for packages: ontop, zipkin, kafka-bridge-fips, dependency-track-apiserver, camunda-zeebe, infinispan, airbyte-server, ontop-fips, airbyte-server-fips, nacos, nacos-docker, knative-kafka-broker-fips, keycloak-fips, apicurio-registry-fips, apache-nifi, hono, knative-kafka-broker,...

GHSA-W737-WX49-QJ23 vulnerabilities

Vulnerabilities for packages: zipkin, keycloak, airbyte-server-fips, dependency-track, keycloak-fips, camunda-zeebe, infinispan, airbyte-server, nacos, nacos-docker, apicurio-registry-fips, apicurio-registry, apache-nifi, dependency-track-apiserver, request-9047-keycloak-fips...

GHSA-G3PR-3P32-FP23 vulnerabilities

Vulnerabilities for packages: ontop, zipkin, kafka-bridge-fips, dependency-track-apiserver, camunda-zeebe, infinispan, airbyte-server, ontop-fips, airbyte-server-fips, nacos, nacos-docker, knative-kafka-broker-fips, keycloak-fips, apicurio-registry-fips, apache-nifi, hono, knative-kafka-broker,...

CVE-2026-40983 vulnerabilities

Vulnerabilities for packages: zipkin, keycloak, airbyte-server-fips, dependency-track, keycloak-fips, camunda-zeebe, infinispan, airbyte-server, nacos, nacos-docker, apicurio-registry-fips, apicurio-registry, apache-nifi, dependency-track-apiserver, request-9047-keycloak-fips...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

EUVD-2026-53716

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

The CVE affects Keycloak’s SAML broker component when configured as an IdP-Initiated flow. The vulnerability arises because OneTimeUse in SAML assertions is not enforced, allowing an attacker who captures a valid, unused assertion to replay it and potentially hijack a user’s session, granting una...

CVE-2026-18967 Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.5 and Red Hat build of Keycloak 26.6.5 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

keycloak: Keycloak: Privilege escalation through hardcoded role mapper injection

A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens,...