CVE-2026-18203: Red Hat Build Of Keycloak

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.

Affected products

• Red Hat Build Of Keycloak: affected versions not specified

Published 2026-07-31. Last modified 2026-08-07.