Security
فارسی
All products

Red Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9

Red Hat · Package
23 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core MavenRed Hat High Fix reported
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output ContextCVE-2026-55858 · GHSA-XVR9-35CR-46V9 org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 MavenRed Hat Medium Fix reported
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsCVE-2026-55857 · GHSA-QXVW-FVWX-5CP7 org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 MavenRed Hat Medium Fix reported
MariaDB has cleartext password disclosure to a MITM on the initial-handshakeCVE-2026-55856 · GHSA-G9JJ-CGMH-9F38 org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 MavenRed Hat Medium Fix reported
keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuerCVE-2026-93998 Red Hat Build of Keycloak/keycloak-coreRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat High No fix reported
keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokensCVE-2026-92857 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat High No fix reported
io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofingCVE-2026-59296 Exploit Intelligence/exploit-intelligence/agent-client-rhel9Red Hat AMQ Broker 7/micrometer-core Red Hat Medium No fix reported
io.netty/netty-codec-socks: Netty: Null byte and CRLF injection in SOCKS client encoders can lead to domain spoofingCVE-2026-62380 Exploit Intelligence/exploit-intelligence/agent-client-rhel9OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 Red Hat Medium No fix reported
quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP SecurityCVE-2026-87743 Red Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9Red Hat Build of Keycloak/keycloak/rhbk-rhel9-operator Red Hat High No fix reported
keycloak-services: keycloak-services: Admin credential DELETE bypasses denied reset-password permissionCVE-2026-94001 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Medium No fix reported
keycloak-services: keycloak-services: Delegated admin with manage-users can escalate to realm-admin via group membershipCVE-2026-94000 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Medium No fix reported
keycloak-services: keycloak-services: Token refresh continues issuing tokens for disabled audience clientsCVE-2026-93999 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Medium No fix reported
keycloak-services: keycloak-services: 2FA setup enforcement bypass via authentication session restart endpointCVE-2026-94218 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Low No fix reported
keycloak-services: keycloak-services: UMA scope merge across resource owners via resource name collisionCVE-2026-94217 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Medium No fix reported
keycloak-services: keycloak-services: Cross-realm client read/write via request-level cache missing realm ownership checkCVE-2026-94215 Red Hat Build of Keycloak/keycloak-servicesRed Hat Build of Keycloak/keycloak/rhbk-openshift-rhel9 Red Hat Medium No fix reported