Red Hat Ships Keycloak 26 4 17 Images Fixing Account Takeover SAML and Netty Smuggling Flaws
Red Hat issued errata RHSA-2026:95760 on 6 November 2026, rated Important, publishing new container images for Red Hat build of Keycloak 26.4.17 and the Keycloak 26.4.17 Operator running on OpenShift Container Platform. Keycloak is Red Hat's integrated single sign-on server, used to centrally authenticate users and manage accounts for web applications, mobile applications and RESTful services, so the images sit directly in the authentication path of whatever they front. The errata carries an unusually long CVE list covering both Keycloak itself and the libraries bundled inside the image, including Netty, Bouncy Castle for Java and jackson-databind. Affected artefacts are the rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images, together with the keycloak-operator-bundle, published for x86_64, aarch64, ppc64le and s390x. Any OpenShift tenant running the Keycloak images below 26.4.17 should treat itself as in scope.
Red Hat publishes one-line summaries for each fix and does not include exploitation details or proof-of-concept code, so the mechanics below are only as deep as the errata itself goes. The identity-layer issues named in the advisory include account takeover via an authentication race on the reset-credentials path (CVE-2026-103112), unverified identity provider email auto-linking that enables account takeover (CVE-2026-97175), a SAML broker accepting holder-of-key assertions without proof of key possession (CVE-2026-92855), and a SAML adapter that does not bind signed assertions to the configured identity provider issuer (CVE-2026-93998). A second cluster concerns data access and token forgery: SQL injection through an unescaped JSON path segment allowing data exfiltration and authorization bypass (CVE-2026-77874), an unvalidated resourceType field in the UMA Protection API permitting cross-owner resource access (CVE-2026-114232), and dynamic client registration gaps that let holders of initial access tokens forge sub and aud claims (CVE-2026-92857) or realm_access.roles (CVE-2026-96547). A third cluster is availability, and several entries are explicitly described as unauthenticated: CPU exhaustion through a SAML 1.1 KeyInfo infinite loop (CVE-2026-107602), JVM termination through a SAML 1.1 AuthorityBinding parsing loop (CVE-2026-110931), and unbounded XML parsing on the SAML SOAP endpoint (CVE-2026-82965). The bundled-library fixes add a large Netty HTTP request smuggling and HTTP/2 downgrade set (CVE-2026-93562, CVE-2026-93566, CVE-2026-93567, CVE-2026-93569, CVE-2026-93573, CVE-2026-93574, CVE-2026-93579), a Bouncy Castle cryptographic signature bypass in RSA PKCS#1 verification (CVE-2026-12860), and a jackson-databind PolymorphicTypeValidator bypass allowing arbitrary class instantiation (CVE-2026-110879).
The significance here is positional rather than exotic. A single sign-on server is the control plane for every downstream application that trusts it, so a flaw that lets an attacker win an authentication race, link an unverified email to an existing account, or forge role claims in a signed token does not stay inside Keycloak: it becomes valid access to everything behind it, carrying legitimate session state and leaving conventional authentication logs looking normal. The unauthenticated SAML parsing loops matter for the same reason in reverse, because taking the identity provider offline takes down login for every dependent service, and these endpoints are commonly internet-reachable by design. On current exploitation status, FIRST EPSS places all of the scored CVEs at low near-term probability, the highest being CVE-2026-110879 at 1.2 percent over the next 30 days, with CVE-2026-103112 and CVE-2026-114232 at 0.3 percent, CVE-2026-107602, CVE-2026-110931, CVE-2026-13506 and CVE-2026-58059 at 0.5 percent, CVE-2026-19611 at 0.9 percent, CVE-2026-18217 at 0.4 percent, CVE-2026-59903 and CVE-2026-75595 at 0.3 percent, and CVE-2026-12860 at 0.2 percent. No exploitation data has been published for the remaining CVEs in the errata, and absence of data is not evidence that they are safe. Red Hat classifies the release as Important and advises backing up applications, configuration files and databases before updating.
Attack Surface
Web Application, Cloud Service, Supply Chain (Third-party vendors)
Tactics
Initial Access, Credential Access, Privilege Escalation, Defense Evasion, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1606.002 – Forge Web Credentials: SAML Tokens
- T1550.001 – Use Alternate Authentication Material: Application Access Token
- T1499.004 – Endpoint Denial of Service: Application or System Exploitation
- T1098 – Account Manipulation
SuperPRO's Threat Countermeasures Procedures
- Pull the Red Hat build of Keycloak 26.4.17 images released in RHSA-2026:95760 and redeploy, pinning by digest: x86_64 rhbk/keycloak-rhel9@sha256:ee390b9a859b3fb42eebe3f69ed84f9aeff420a399cb333d0ffde20b20737907 and rhbk/keycloak-rhel9-operator@sha256:13cd7de1650a677269ab7e19265750b3c1fb78d7d7f6d9b584b19337986c0f81, with aarch64, ppc64le and s390x digests taken from the same errata.
- Update the Operator deployment using rhbk/keycloak-operator-bundle@sha256:a4724ec1097535e5a67cbca4173f764b01a77ba8a939e0606f71cc7d0fd3488d so the Operator does not reconcile managed Keycloak pods back to a pre-26.4.17 image after the StatefulSet is patched.
- Back up the Keycloak realm database, configuration files and any customised themes or provider JARs before rolling the new images, as instructed in the Solution section of RHSA-2026:95760, since the errata applies database-affecting product changes.
- Follow the installation instructions in RHSA-2026:95760 to pull the replacement images from registry.redhat.io with podman and restart the running Keycloak containers, as the errata states the updated images take effect only once the running instances are redeployed.
- Confirm the architecture in use is covered by pulling the matching image published in RHSA-2026:95760 for x86_64, aarch64, ppc64le or s390x, and verify that running pods report Red Hat build of Keycloak 26.4.17 rather than an earlier tag.
- Use the per-CVE pages linked from RHSA-2026:95760 (including CVE-2026-103112, CVE-2026-97175, CVE-2026-92855 and CVE-2026-93998) to review Red Hat's CVSS scores and affected-component detail for each issue and scope which Keycloak realms and features are in use locally.
- Apply RHSA-2026:95760 to every deployment of the rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images, not only OpenShift Container Platform clusters, since the errata lists the container images themselves as the affected artefacts.
