Red Hat Product Errata RHSA-2026:56524 - Security Advisory Issued: 2026-08-18 Updated: 2026-08-18 RHSA-2026:56524 - Security Advisory Overview Updated Images Synopsis Critical: Red Hat build of Keycloak 26.6.6 Images Security Update Type/Severity Security Advisory: Critical Topic New images are available for Red Hat build of Keycloak 26.6.6 and Red Hat build of Keycloak 26.6.6 Operator, running on OpenShift Container Platform Description Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.6.6 clusters. This erratum releases new images for Red Hat build of Keycloak 26.6.6 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission (CVE-2026-14613) Predictable account-linking hash enables account takeover via malicious OIDC client (CVE-2026-15571) Vault-resolved rotated client secrets leaked via Admin REST API (CVE-2026-17048) Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963) Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability (CVE-2026-9796) Solution Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Affected Products Red Hat build of Keycloak Text-only Advisories x86_64 Fixes (none) CVEs CVE-2026-9796 CVE-2026-13757 CVE-2026-14613 CVE-2026-15571 CVE-2026-17048 CVE-2026-18963 References https://access.redhat.com/security/updates/classification/#critical aarch64 rhbk/keycloak-rhel9@sha256:413763d73d26774b9278d71dd2eea226bedaeac307ee146736a7ffbf7f613f0d rhbk/keycloak-rhel9-operator@sha256:44d03f041fd1760001776e4e08d1f4716da4dd00d50476c91206b6db4934147d ppc64le rhbk/keycloak-rhel9@sha256:9c2a11371c3edb48bb24413a0aa60ff01efcdd2c1af45b07905f216e4648675f rhbk/keycloak-rhel9-operator@sha256:c32f09e3b7c212e7fd6b4a9b7b5857e4fd18d4416e5d256ca99299377edeb05e s390x rhbk/keycloak-rhel9@sha256:e5a8533ccec075ff65f3447fd186a14069452e4446331a8f95530a2a86cb52a7 rhbk/keycloak-rhel9-operator@sha256:80434d4628a04d1c82ea21c0ed0b0e4122823686cab030afcd77ec485c5b7d18 x86_64 rhbk/keycloak-operator-bundle@sha256:59dc8a796829d2ffd605425348c9801ae38823da3269006a1fcc7d013a41eb30 rhbk/keycloak-rhel9@sha256:2bf0b7db309d716f5ced722869f59a7307aaff57e9c223a1e594145a560c8178 rhbk/keycloak-rhel9-operator@sha256:c1ce5e79c69440caa9ccc761167b068e259cd126dfbdde28e36ae590c2bf60f5 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .