Red hat build of keycloak 26.4.13

This hub aggregates every CVE we track for Red hat build of keycloak 26.4.13, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat build of keycloak 26.4.13.

• CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probing4.9Jun 25, 2026
• CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass4.6Jun 25, 2026
• CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token6.5Jun 25, 2026
• CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass7.3Jun 25, 2026
• CVE-2026-9099Keycloak: group-admin escalation to realm-admin7.7Jun 25, 2026
• CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison8.1Jun 25, 2026
• CVE-2026-9088Keycloak: keycloak: information disclosure due to user profile permission bypass2.7Jun 5, 2026
• CVE-2026-9803Keycloak: keycloak: denial of service via malformed authorization header5.3May 28, 2026
• CVE-2026-9802Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart6.8May 28, 2026
• CVE-2026-9801Keycloak: keycloak: denial of service via malformed ldap password policy response4.9May 28, 2026
• CVE-2026-9795Keycloak: keycloak: privilege escalation via improper scope mapping enforcement7.3May 28, 2026
• CVE-2026-9794Keycloak: keycloak: information disclosure via saml ecp endpoint5.3May 28, 2026
• CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition6.5May 28, 2026
• CVE-2026-9791Keycloak-rhel9: organization data leak after feature disabled in keycloak4.3May 28, 2026
• CVE-2026-9704Keycloak: keycloak: privilege escalation due to oversized subject_token jwt6.8May 27, 2026