# Red Hat build of Keycloak 26.6.

Every CVE that names Red Hat build of Keycloak 26.6 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Keycloak-services: keycloak-services: broker-originated username collision causes account lockout](https://agentprime.io/advisories/CVE-2026-19607.md)
  `CVE-2026-19607` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts](https://agentprime.io/advisories/CVE-2026-17526.md)
  `CVE-2026-17526` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching](https://agentprime.io/advisories/CVE-2026-79651.md)
  `CVE-2026-79651` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments](https://agentprime.io/advisories/CVE-2026-74909.md)
  `CVE-2026-74909` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state](https://agentprime.io/advisories/CVE-2026-18212.md)
  `CVE-2026-18212` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters](https://agentprime.io/advisories/CVE-2026-19729.md)
  `CVE-2026-19729` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [Resteasy-core: resteasy sourceprovider remote unauthenticated file read](https://agentprime.io/advisories/CVE-2026-17615.md)
  `CVE-2026-17615` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: XML external entities (XXE)
- [Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired](https://agentprime.io/advisories/CVE-2026-79652.md)
  `CVE-2026-79652` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client](https://agentprime.io/advisories/CVE-2026-15571.md)
  `CVE-2026-15571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-341
- [Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation](https://agentprime.io/advisories/CVE-2026-15572.md)
  `CVE-2026-15572` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Memory corruption
- [Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction](https://agentprime.io/advisories/CVE-2026-16442.md)
  `CVE-2026-16442` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-346
- [Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text](https://agentprime.io/advisories/CVE-2026-16100.md)
  `CVE-2026-16100` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service
- [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md)
  `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation
- [Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers](https://agentprime.io/advisories/CVE-2026-16102.md)
  `CVE-2026-16102` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-551
- [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md)
  `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551
- [Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation](https://agentprime.io/advisories/CVE-2026-16443.md)
  `CVE-2026-16443` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS
- [Keycloak-services: keycloak-services: client access-type policy condition bypass during client update](https://agentprime.io/advisories/CVE-2026-18573.md)
  `CVE-2026-18573` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes](https://agentprime.io/advisories/CVE-2026-18572.md)
  `CVE-2026-18572` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation](https://agentprime.io/advisories/CVE-2026-18571.md)
  `CVE-2026-18571` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed](https://agentprime.io/advisories/CVE-2026-18570.md)
  `CVE-2026-18570` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md)
  `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction](https://agentprime.io/advisories/CVE-2026-18214.md)
  `CVE-2026-18214` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints](https://agentprime.io/advisories/CVE-2026-16105.md)
  `CVE-2026-16105` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant](https://agentprime.io/advisories/CVE-2026-18215.md)
  `CVE-2026-18215` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero](https://agentprime.io/advisories/CVE-2026-18218.md)
  `CVE-2026-18218` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations](https://agentprime.io/advisories/CVE-2026-18201.md)
  `CVE-2026-18201` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter](https://agentprime.io/advisories/CVE-2026-17059.md)
  `CVE-2026-17059` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api](https://agentprime.io/advisories/CVE-2026-17048.md)
  `CVE-2026-17048` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure
- [Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins](https://agentprime.io/advisories/CVE-2026-16104.md)
  `CVE-2026-16104` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Hard-coded credentials, CWE-212
- [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md)
  `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md)
  `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220
- [Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers](https://agentprime.io/advisories/CVE-2026-16093.md)
  `CVE-2026-16093` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-807
- [Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session](https://agentprime.io/advisories/CVE-2026-16089.md)
  `CVE-2026-16089` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Authentication bypass, CWE-472
- [Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation](https://agentprime.io/advisories/CVE-2026-16072.md)
  `CVE-2026-16072` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, Information disclosure
- [Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2](https://agentprime.io/advisories/CVE-2026-15945.md)
  `CVE-2026-15945` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter](https://agentprime.io/advisories/CVE-2026-14615.md)
  `CVE-2026-14615` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-1220
- [Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource](https://agentprime.io/advisories/CVE-2026-14614.md)
  `CVE-2026-14614` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission](https://agentprime.io/advisories/CVE-2026-14613.md)
  `CVE-2026-14613` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions](https://agentprime.io/advisories/CVE-2026-14209.md)
  `CVE-2026-14209` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Keycloak: group-admin escalation to realm-admin](https://agentprime.io/advisories/CVE-2026-9099.md)
  `CVE-2026-9099` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 7.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-build-of-keycloak-26-6>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-build-of-keycloak-26-6/>. Everything for agents: <https://agentprime.io/llms.txt>.