GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, kafbat-ui, airbyte-server-fips, management-api-for-apache-cassandra-4.0, nacos-docker, keycloak-config-cli, akhq, zookeeper-fips, knative-kafka-broker, s3proxy, s3proxy-fips, airbyte-server, zookeeper, ontop-fips, cassandra-reaper,...

CVE-2026-2092 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips, request-9047-keycloak-fips...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, kafbat-ui, airbyte-server-fips, management-api-for-apache-cassandra-4.0, nacos-docker, keycloak-config-cli, akhq, zookeeper-fips, knative-kafka-broker, s3proxy, s3proxy-fips, airbyte-server, zookeeper, ontop-fips, cassandra-reaper,...

GHSA-WMXR-6J5F-838P vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips, request-9047-keycloak-fips...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: nextflow, akhq, sonar-scanner-cli, sonarqube, cassandra, keycloak-config-cli, zookeeper, cassandra-reaper, management-api-for-apache-cassandra-5.0, kserve-modelmesh...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: nextflow, akhq, sonar-scanner-cli, sonarqube, cassandra, keycloak-config-cli, zookeeper, cassandra-reaper, management-api-for-apache-cassandra-5.0, kserve-modelmesh...

PT-2026-55551

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Fine-Grained Admin Permissions FGAP v2 implementation within the administrative services. When FGAP v2 is enabled, the system does not correctly filter child groups base...

PT-2026-55550

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the ClientResource component of the admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator with limited control...

Keycloak < 26.6.4 Multiple Vulnerabilities

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following: - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control over the realm. CVE-2026-9099 - An...

PT-2026-55549

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue in the administrative interface occurs when Fine-Grained Admin Permissions FGAP v2 are enabled. An administrator with permission to view a specific role can access a list of all...

EUVD-2026-12688

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions...

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading...

GHSA-794G-X443-36F7 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading...

PT-2026-55372

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading...

GHSA-32H4-44JJ-C5VX Keycloak has privilege escalation via improper scope mapping enforcement

Description A flaw was found in Keycloak's Fine-Grained Admin Permissions FGAPv2 feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended...

EUVD-2026-32710

Keycloak has privilege escalation via improper scope mapping enforcement...

CVE-2026-4629

A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens,...

CVE-2026-14209

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

CVE-2026-12388

A flaw was found in the Identity Provider IdP mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role"...

EUVD-2026-40301

A flaw was found in the Identity Provider IdP mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role"...