Keycloak: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• Medium 6.5
  CVE-2026-17059

  Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

  A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view in…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Jul 24, 2026
• Medium 5.5
  CVE-2026-17048

  Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

  A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a del…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Jul 24, 2026

Revision history

1. 2026-09-16 #4

   Neue Updates von Red Hat aufgenommen

2. 2026-08-30 #3

   Neue Updates aufgenommen

3. 2026-08-18 #2

   Neue Updates aufgenommen

4. 2026-07-26 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-07-26
  https://github.com/advisories/GHSA-P3WJ-5684-X596
• GitHub Advisory Database vom 2026-07-26
  https://github.com/advisories/GHSA-4W3X-69M8-478C
• Red Hat Bugtracker 2506743 vom 2026-07-26
  https://bugzilla.redhat.com/show_bug.cgi?id=2506743
• Red Hat Bugtracker 2506746 vom 2026-07-26
  https://bugzilla.redhat.com/show_bug.cgi?id=2506746
• Keycloak 26.7.2 release vom 2026-08-19
  https://www.keycloak.org/2026/08/keycloak-2672-released
• Red Hat Security Advisory RHSA-2026:56524 vom 2026-08-18
  https://access.redhat.com/errata/RHSA-2026:56524
• Red Hat Security Advisory RHSA-2026:56523 vom 2026-08-19
  https://access.redhat.com/errata/RHSA-2026:56523
• ### vom 2026-08-31
  https://www.keycloak.org/2026/08/keycloak-2673-released
• Red Hat Security Advisory RHSA-2026:68277 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68277
• Red Hat Security Advisory RHSA-2026:68278 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68278