# Red Hat build of Keycloak 26.6.5.

Every CVE that names Red Hat build of Keycloak 26.6.5 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation](https://agentprime.io/advisories/CVE-2026-15572.md)
  `CVE-2026-15572` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Memory corruption
- [Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction](https://agentprime.io/advisories/CVE-2026-16442.md)
  `CVE-2026-16442` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346
- [Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text](https://agentprime.io/advisories/CVE-2026-16100.md)
  `CVE-2026-16100` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md)
  `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation
- [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md)
  `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551
- [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md)
  `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551
- [Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation](https://agentprime.io/advisories/CVE-2026-16443.md)
  `CVE-2026-16443` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS
- [Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter](https://agentprime.io/advisories/CVE-2026-14615.md)
  `CVE-2026-14615` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-1220
- [Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource](https://agentprime.io/advisories/CVE-2026-14614.md)
  `CVE-2026-14614` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control
- [Keycloak: keycloak: privilege escalation through hardcoded role mapper injection](https://agentprime.io/advisories/CVE-2026-4629.md)
  `CVE-2026-4629` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Privilege escalation
- [Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions](https://agentprime.io/advisories/CVE-2026-14209.md)
  `CVE-2026-14209` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-build-of-keycloak-26-6-5>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-build-of-keycloak-26-6-5/>. Everything for agents: <https://agentprime.io/llms.txt>.