Red Hat products listed as vulnerable in advisory AV26-1136
The November 9 notice covers many Red Hat products, mostly all versions, and tells admins to apply updates.
Stories per day · 30 days
1 RSS
Relatedaccess-tokens1account-takeover1airflow1ansible1apache1apache-airflow1apache-camel1audit-logs1authentication1authorization1camel-keycloak1cve-2026-922281cve-2026-968061decentralized1e2ee1exploit-db1jwt1oidc1
9 stories, newest first · one card per story
Stories tagged #keycloak
TideCloak: Keycloak authority replaced with decentralized Fabric
TideCloak delivers OIDC-compatible IAM with zero-knowledge auth and E2EE via threshold cryptography on the Tide Fabric.
Camel Keycloak accepts expired tokens from unbounded cache (CVE-2026-95663)
Cached introspection results are not limited by token expiry, so expired access tokens can still be accepted.
Keycloak 26.7.2 unauthenticated account takeover exploit published
Exploit-DB lists a web-app exploit that takes over accounts in Keycloak 26.7.2 without authentication.
CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Apache Airflow's Keycloak provider before 0.11.1 lets any team member read every team's audit logs.
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation
Apache APISIX authz-keycloak can carry one request's permissions into later requests (CVE-2026-82806).
Siemens Industrial Edge Management
Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.
1
CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.
5