Red Hat Build Of Keycloak 26.4.10 vulnerabilities

3 CVEs affecting Red Hat Build Of Keycloak 26.4.10, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2733, published 2026-02-19.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-2733, published 2026-02-19. Low severity, CVSS 3.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that…
• CVE-2026-1190, published 2026-01-26. Low severity, CVSS 3.1. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter`…
• CVE-2026-0707, published 2026-01-08. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as…