Red Hat Build Of Keycloak 26.6 vulnerabilities

13 CVEs affecting Red Hat Build Of Keycloak 26.6, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19607, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18963, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 3.2% chance of exploitation in the next 30 days. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an…
CVE-2026-40984, published 2026-06-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5;…
CVE-2026-40983, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0…
CVE-2026-74909, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web…
CVE-2026-79651, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue…
CVE-2026-17615, published 2026-08-31. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a…
CVE-2026-18212, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and…
CVE-2026-19607, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity…
CVE-2026-19729, published 2026-09-09. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing…
CVE-2026-17526, published 2026-09-16. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the…

Latest

CVE-2026-79652, published 2026-08-25. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect…
CVE-2026-15571, published 2026-08-18. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the…