RedHat Build of Keycloak: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• High 8.8
  CVE-2026-15572

  Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

  A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update …

  Red Hat Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.6.5
  Aug 5, 2026
• High 8.1
  CVE-2026-15573

  Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

  A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix param…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Aug 5, 2026
• High 8.1
  CVE-2026-16102

  Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

  A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Aug 5, 2026
• High 7.4
  CVE-2026-16442

  Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

  A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking on…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Aug 5, 2026
• Medium 6.5
  CVE-2026-16100

  Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

  A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like non…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Aug 5, 2026
• Medium 6.4
  CVE-2026-18967

  Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

  A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacke…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Build of Keycloak
  Aug 6, 2026
• Medium 5.4
  CVE-2026-16071

  Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

  A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missi…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.6
  Aug 5, 2026

Revision history

1. 2026-11-05 #3

   Neue Updates aufgenommen

2. 2026-09-16 #2

   Neue Updates von Red Hat aufgenommen

3. 2026-08-05 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-6J7G-HR6V-3HXC
• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-6X4H-V8CP-WHWH
• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-M28W-C4HX-9FVG
• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-XJ3W-M54W-H7P9
• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-VJ6M-HV26-QX79
• GitHub Advisory Database vom 2026-08-05
  https://github.com/advisories/GHSA-CJ2R-7GQH-WX4F
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53381
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53382
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53383
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53384
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53395
• EU Vulnerability Database vom 2026-08-05
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-53398
• EU Vulnerability Database vom 2026-08-05
  https://github.com/advisories/GHSA-fghp-hcwh-75j2
• Red Hat Security Advisory RHSA-2026:68280 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68280
• Red Hat Security Advisory RHSA-2026:68278 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68278
• Red Hat Security Advisory RHSA-2026:68276 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68276
• Red Hat Security Advisory RHSA-2026:68277 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68277
• Keycloak 26.8.2 Release Notes vom 2026-11-05
  https://www.keycloak.org/2026/11/keycloak-2682-released