Red Hat Build Of Keycloak 26.6.7 vulnerabilities

8 CVEs affecting Red Hat Build Of Keycloak 26.6.7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19607, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-74909, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web…
CVE-2026-79651, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue…
CVE-2026-17615, published 2026-08-31. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a…
CVE-2026-18212, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and…
CVE-2026-19607, published 2026-09-16. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity…
CVE-2026-19729, published 2026-09-09. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing…
CVE-2026-17526, published 2026-09-16. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the…
CVE-2026-79652, published 2026-08-25. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect…