CLEANSTART-2026-KC06018 Security fixes for CVE-2017-12158, CVE-2017-12159, ghsa-3p8m-j85q-pgmj, ghsa-45p5-v273-3qqr, ghsa-4cx2-fc23-5wg6, ghsa-5rfx-cp42-p624, ghsa-72hv-8253-57qq, ghsa-84h7-rjj3-6jx4, ghsa-9342-92gg-6v29, ghsa-cbdj-484d-3x9q, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-hq9p-pm7w-8p54, ghsa-j288-q9x7-2f5v, ghsa-pwqr-wmgm-9rr8, ghsa-w9fj-cfpg-grvv applied in versions: 26.1.4-r1, 26.5.0-r0, 26.5.0-r1, 26.5.0-r2, 26.5.6-r3

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details...

Keycloak 访问控制错误漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak itself. Keycloak has a vulnerability related to access control, which stems from a header injection vulnerability in the user management access token endpoint. This vulnerability may lead to the disclosure of...

PT-2026-30582

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak that allows a remote attacker to exploit a Cross-Origin Resource Sharing CORS header injection in the User-Managed Access UMA token endpoint. The issue arises becau...

GHSA-RHGQ-F8X5-J2JC vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak, request-9047-keycloak-fips...

CVE-2026-4282 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4628 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2026-4874 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

GHSA-H4WV-G838-66G3 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-HJ93-H7PG-FH6V vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-4PGC-GFRR-WCMG vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2026-4325 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4636 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-RX66-HJ7G-28H7 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4633 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak, request-9047-keycloak-fips...

GHSA-CJM2-J6CM-6P6M vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-22RM-WP4X-V5CX vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2026-3872 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4634 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-F2HX-5FX3-HMCV vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Behavior Order: Authorization Before Parsing and Canonicalization via the UMA Policy Resource user...