Red Hat Vulnerabilities and Affected Products

Products

Red Hat Enterprise Linux 91,515 vulnerabilities
Red Hat Enterprise Linux 81,496 vulnerabilities
Red Hat Enterprise Linux 71,145 vulnerabilities
Red Hat Enterprise Linux 101,132 vulnerabilities
Red Hat Enterprise Linux 61,113 vulnerabilities
Red Hat OpenShift Container Platform 4430 vulnerabilities
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
Red Hat OpenShift AI (RHOAI)302 vulnerabilities
Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
Red Hat Hardened Images277 vulnerabilities
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
Red Hat Single Sign-On 7177 vulnerabilities
Red Hat Fuse 7175 vulnerabilities

Red Hat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-14180MEDIUM	Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggle… CWE-444Aug 11, 2026	CVSS5.3v3.1	EPSS0.413%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15565HIGH	Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake. CWE-120Aug 11, 2026	CVSS7.5v3.1	EPSS0.476%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16442HIGH	Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account. CWE-346Aug 5, 2026	CVSS7.4v3.1	EPSS0.202%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16100MEDIUM	Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable. CWE-770Aug 5, 2026	CVSS6.5v3.1	EPSS0.307%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16071MEDIUM	Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local s… CWE-269Aug 5, 2026	CVSS5.4v3.1	EPSS0.181%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16102HIGH	Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confident… CWE-284Aug 5, 2026	CVSS8.1v3.1	EPSS0.253%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15573HIGH	Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see. CWE-178Aug 5, 2026	CVSS8.1v3.1	EPSS0.29%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16443HIGH	Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by kn… CWE-347Aug 5, 2026	CVSS7.4v3.1	EPSS0.154%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18569LOW	Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this … CWE-347Aug 4, 2026	CVSS3.7v3.1	EPSS0.16%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18573MEDIUM	Keycloak-services: keycloak-services: client access-type policy condition bypass during client update A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confide… CWE-862Aug 2, 2026	CVSS6.5v3.1	EPSS0.221%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18572MEDIUM	Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. CWE-863Aug 2, 2026	CVSS6.5v3.1	EPSS0.182%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18571MEDIUM	Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users. CWE-862Aug 2, 2026	CVSS6.6v3.1	EPSS0.245%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18570MEDIUM	Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows t… CWE-862Aug 2, 2026	CVSS5.4v3.1	EPSS0.141%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18209LOW	Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it … CWE-1288Jul 31, 2026	CVSS3.4v3.1	EPSS0.193%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18206LOW	Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-bas… CWE-20Jul 31, 2026	CVSS3.7v3.1	EPSS0.201%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18214MEDIUM	Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm. CWE-862Jul 31, 2026	CVSS6.8v3.1	EPSS0.189%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18203MEDIUM	Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources. CWE-863Jul 31, 2026	CVSS6.5v3.1	EPSS0.182%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18211MEDIUM	Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensi… CWE-20Jul 31, 2026	CVSS4.2v3.1	EPSS0.178%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18208MEDIUM	Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token cl… CWE-862Jul 31, 2026	CVSS6.5v3.1	EPSS0.201%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16105MEDIUM	Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm. CWE-862Jul 31, 2026	CVSS4.9v3.1	EPSS0.192%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18215MEDIUM	Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions. CWE-287Jul 31, 2026	CVSS6.8v3.1	EPSS0.188%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18217LOW	Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the at… CWE-20Jul 31, 2026	CVSS3.4v3.1	EPSS0.193%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18218MEDIUM	Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to inval… CWE-862Jul 31, 2026	CVSS4.2v3.1	EPSS0.131%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18201MEDIUM	Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations. CWE-862Jul 29, 2026	CVSS5.5v3.1	EPSS0.285%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18207MEDIUM	Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles. CWE-285Jul 29, 2026	CVSS6.5v3.1	EPSS0.292%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX