CLEANSTART-2026-TA42758 Security fixes for ghsa-3p8m-j85q-pgmj, ghsa-45p5-v273-3qqr, ghsa-4cx2-fc23-5wg6, ghsa-9342-92gg-6v29, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-hq9p-pm7w-8p54, ghsa-j288-q9x7-2f5v applied in versions: 26.1.4-r1

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-65XW-VW82-R86X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-s3, crossplane-provider-azure-storage,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, crossplane-provider-aws-kinesis, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-s3, crossplane-provider-azure-storage,...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: infinispan, spark, wildfly, zipkin, sonarqube, celeborn, opensearch, kserve-modelmesh, wavefront-proxy, flyway, druid, apache-pulsar, management-api-for-apache-cassandra-5.0, keycloak, apicurio-registry, thingsboard, trino, neo4j, strimzi-kafka-operator, akhq...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: infinispan, spark, wildfly, zipkin, sonarqube, celeborn, opensearch, kserve-modelmesh, wavefront-proxy, flyway, druid, apache-pulsar, management-api-for-apache-cassandra-5.0, keycloak, apicurio-registry, thingsboard, trino, neo4j, strimzi-kafka-operator, akhq...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, wazuh-indexer, camunda-zeebe, flyway-fips, apicurio-registry, elasticsearch, kayenta-fips, kserve-modelmesh, pinot-fips, infinispan, celeborn, reposilite, apache-pulsar, management-api-for-apache-cassandra-5.0, keycloak, apache-pulsar-fips,...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, wazuh-indexer, camunda-zeebe, flyway-fips, apicurio-registry, elasticsearch, kayenta-fips, kserve-modelmesh, pinot-fips, infinispan, celeborn, reposilite, apache-pulsar, management-api-for-apache-cassandra-5.0, keycloak, apache-pulsar-fips,...

GHSA-PWQR-WMGM-9RR8 vulnerabilities

Vulnerabilities for packages: logstash, infinispan, spark, wildfly, zipkin, apache-activemq-artemis, sonarqube, celeborn, opensearch, kserve-modelmesh, wavefront-proxy, flyway, druid, apache-pulsar, management-api-for-apache-cassandra-5.0, tez, keycloak, apicurio-registry, thingsboard, trino,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: logstash, infinispan, spark, wildfly, zipkin, apache-activemq-artemis, sonarqube, celeborn, opensearch, kserve-modelmesh, wavefront-proxy, flyway, druid, apache-pulsar, management-api-for-apache-cassandra-5.0, tez, keycloak, apicurio-registry, thingsboard, trino,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: elasticsearch-fips, wazuh-indexer, camunda-zeebe, flyway-fips, apicurio-registry, elasticsearch, kayenta-fips, kserve-modelmesh, pinot-fips, infinispan, celeborn, reposilite, apache-pulsar, management-api-for-apache-cassandra-5.0, keycloak, apache-pulsar-fips,...

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

GHSA-7XF9-4JFC-WGM4 Keycloak: manage-clients permission escalates to full realm admin access

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

EUVD-2026-16309

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

Keycloak: manage-clients permission escalates to full realm admin access

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

EUVD-2026-16307

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

GHSA-Q35R-VVHV-VX5H Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

CVE-2026-3121

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

CVE-2026-3190

A flaw was found in Keycloak. The User-Managed Access UMA 2.0 Protection API endpoint for permission tickets fails to enforce the umaprotection role check. This allows any authenticated user with a token issued for a resource server client, even without the umaprotection role, to enumerate all...

CVE-2026-3121

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...

CVE-2026-3121 Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

A flaw was found in Keycloak. An administrator with manage-clients permission can exploit a misconfiguration where this permission is equivalent to manage-permissions. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within...