CVE-2026-54514 vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, apicurio-registry, s3proxy-fips, commercial-elasticsearch, spark-kubernetes-operator-fips, ruby4.0-jrjackson, airflow, wso2is, spark-kubernetes-operator, cassandra-fips, hono, localstack, elasticsearch, elasticsearch-fips, nacos, nextflow,...

GHSA-J3RV-43J4-C7QM vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, apicurio-registry, s3proxy-fips, commercial-elasticsearch, spark-kubernetes-operator-fips, ruby4.0-jrjackson, airflow, wso2is, spark-kubernetes-operator, cassandra-fips, hono, localstack, elasticsearch, elasticsearch-fips, nacos, nextflow,...

GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, apicurio-registry, s3proxy-fips, commercial-elasticsearch, spark-kubernetes-operator-fips, ruby4.0-jrjackson, airflow, wso2is, spark-kubernetes-operator, cassandra-fips, hono, localstack, elasticsearch, elasticsearch-fips, nacos, nextflow,...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

GHSA-HGJ6-7826-R7M5 vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, apicurio-registry, s3proxy-fips, commercial-elasticsearch, spark-kubernetes-operator-fips, ruby4.0-jrjackson, airflow, wso2is, spark-kubernetes-operator, cassandra-fips, hono, localstack, elasticsearch, elasticsearch-fips, nacos, nextflow,...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: dependency-track-apiserver, apicurio-registry, s3proxy-fips, commercial-elasticsearch, spark-kubernetes-operator-fips, ruby4.0-jrjackson, airflow, wso2is, spark-kubernetes-operator, cassandra-fips, hono, localstack, elasticsearch, elasticsearch-fips, nacos, nextflow,...

GHSA-5HH8-Q8HV-FR38 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

CVE-2026-54518 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

GHSA-9FXM-VC8V-HJ55 vulnerabilities

Vulnerabilities for packages: jenkins, opensearch-fips, kafka-fips, dependency-track-apiserver, ruby3.3-jrjackson, spark, solr, spark-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips, apicurio-registry, apache-tika-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.1,...

PT-2026-52508

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the client registration service allows a remote attacker with a previously issued Registration Access Token RAT to re-enable a client that was explicitly disabled by an...

PT-2026-52507

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing...

PT-2026-52510

Name of the Vulnerable Software and Affected Versions Keycloak Policy Enforcer affected versions not specified Description An issue exists that allows authenticated users to bypass authorization policies, including role, scope, and User-Managed Access UMA permission checks. An attacker can gain...

PT-2026-52506

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists where a remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, can bypass client Uniform...

PT-2026-52592

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A JWT algorithm confusion flaw exists in the JWT Authorization Grant flow. An attacker possessing valid client credentials can bypass signature verification by forging an assertion. This...

PT-2026-52505

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A realm administrator with the manage-realm role can probe arbitrary filesystem paths by submitting an arbitrary path as a keystore parameter during the creation of a key provider component...

Information Disclosure

Keycloak is vulnerable to Information Disclosure. The vulnerability is due to insufficient enforcement of user profile permissions in the group members endpoint, allowing an administrator with delegated access to read group memberships and users to view user attributes that are explicitly...

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...

Improper Access Control

Keycloak is vulnerable to Improper Access Control. The vulnerability is due to insufficient audience restriction enforcement in the OpenID Connect token introspection endpoint, which allows an authenticated confidential client to access sensitive token claims intended for other resource servers...