Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:95508 | (RHSA-2026:95508) Critical: OpenShift Container Platform 4.14.78 bug fix and security update | November 9, 2026 |
| RHSA-2026:96365 | (RHSA-2026:96365) Red Hat Hardened Images RPMs Security Update | November 9, 2026 |
| RHSA-2026:96333 | (RHSA-2026:96333) Red Hat Enterprise Linux AI 3.5.3 enhancement update | November 9, 2026 |
| RHSA-2026:96323 | (RHSA-2026:96323) Red Hat Enterprise Linux AI 3.5.3 enhancement update | November 9, 2026 |
| RHSA-2026:94537 | (RHSA-2026:94537) Critical: OpenShift Container Platform 5.0.1 bug fix and security update | November 9, 2026 |
| RHSA-2026:95416 | (RHSA-2026:95416) Critical: OpenShift Container Platform 4.12.103 bug fix update | November 9, 2026 |
| RHSA-2026:96293 | (RHSA-2026:96293) Red Hat Edge Manager Version 1.3.2 Security Update | November 9, 2026 |
| RHSA-2026:96291 | (RHSA-2026:96291) Red Hat Edge Manager Version 1.3.2 Security Update | November 9, 2026 |
| RHSA-2026:95417 | (RHSA-2026:95417) OpenShift Container Platform 4.12.103 bug fix and security update | November 9, 2026 |
| RHSA-2026:96250 | (RHSA-2026:96250) Important: cockpit security update | November 9, 2026 |
By the Year
In 2026 there have been 5704 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1206 security vulnerabilities published. That is, 4498 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.40.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 5704 | 7.28 |
| 2025 | 1206 | 6.88 |
| 2024 | 1705 | 6.83 |
| 2023 | 1208 | 6.74 |
| 2022 | 1362 | 6.98 |
| 2021 | 1123 | 6.54 |
| 2020 | 664 | 6.37 |
| 2019 | 772 | 6.93 |
| 2018 | 762 | 7.17 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-112314 | Nov 09, 2026 |
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, whichclnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112321 | Nov 09, 2026 |
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requestsThe AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112320 | Nov 09, 2026 |
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switchesThe GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112319 | Nov 09, 2026 |
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requestsThe GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112318 | Nov 09, 2026 |
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy nameThe policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112316 | Nov 09, 2026 |
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requestsxdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112317 | Nov 09, 2026 |
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requestskrb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112315 | Nov 09, 2026 |
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, whichThe RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-12977 | Nov 09, 2026 |
A flaw was found in the deployment-operation family of WildFly CoreA flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server. |
Jboss Fuse
Jboss Enterprise Application Platform
Jbosseapxp
And others... |
| CVE-2026-119079 | Nov 09, 2026 |
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, whichdecode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112323 | Nov 09, 2026 |
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and laterThe AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-112322 | Nov 09, 2026 |
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scanclean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-125041 | Nov 09, 2026 |
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxerA flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the sample is copied, potentially crashing the application and causing denial of service. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-125040 | Nov 09, 2026 |
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-baseA flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-84503 | Nov 09, 2026 |
Ansible-Core git module argument injection (CVE-2026-84503)A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module. |
Migration Toolkit Applications
Migration Toolkit Virtualization
Service Mesh
And others... |
| CVE-2026-125063 | Nov 09, 2026 |
Red Hat Automation Controller rrule ReDoS DoS via REST APIA flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability. |
Ansible Automation Platform
|
| CVE-2026-19706 | Nov 09, 2026 |
OpenShift approve-csr.service signs any CSR without validationDuring ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window. |
Assisted Installer
Multicluster Engine
Openshift
And others... |
| CVE-2026-121611 | Nov 09, 2026 |
GStreamer gst-plugins-bad HEVC parser useofuninitialized memory DoSA flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-121601 | Nov 09, 2026 |
GStreamer MXF demuxer OOB read & DoS (gst-plugins-bad)A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-119610 | Nov 09, 2026 |
GStreamer gst-plugins-good H.264 RTP depayloader OOB heap read (CVE-2026-119610)A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-121629 | Nov 09, 2026 |
GStreamer Adaptive Streaming Demuxer Unrestricted URI Scheme File ReadA flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable. |
Enterprise Linux (RHEL)
Rhel Els
|
| CVE-2026-93879 | Nov 08, 2026 |
Hibernate Validator EL Injection DoS (CVE-2026-93879)Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions. |
|
| CVE-2026-120984 | Nov 07, 2026 |
Keycloak client management auth bypass enabling JS policy injectionA flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-83495 | Nov 07, 2026 |
Red Hat Trainer v2 TrainJob API SecretKeyRef Injection (RBAC Escalation)A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting `valueFrom.secretKeyRef` into environment variable definitions. This allows them to read and exfiltrate sensitive information (secrets) from the namespace, leading to a privilege escalation. This occurs when the TrainJob Role-Based Access Control (RBAC) is broader than the Secret read RBAC. |
Openshift Ai
|
| CVE-2026-50240 | Nov 06, 2026 |
Red Hat OpenShift PAC Privilege Escalation via Unchecked Repo CreatorA flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces. |
Openshift Builds
Openshift Pipelines
Serverless
And others... |
| CVE-2026-123876 | Nov 06, 2026 |
Podman seccomp AF_VSOCK/NETLINK_AUDIT bypass via 64-bit int truncationA flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-119170 | Nov 06, 2026 |
CPython 3.14.10 hashlib FIPS enforcement regressionThere was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected. |
|
| CVE-2026-120749 | Nov 06, 2026 |
D-Bus Daemon DoS via Driver Broadcast Delivery FailureA flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service. |
Enterprise Linux (RHEL)
Rhel Els
Hummingbird
And others... |
| CVE-2026-83494 | Nov 06, 2026 |
Kubeflow Training Operator Webhook Object Cast Bypass leading to DoSA flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition. |
Openshift Ai
|
| CVE-2026-83493 | Nov 06, 2026 |
Snyk Distributed Workloads PR Target Secret Leak via pull_request_targetA flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository. |
Openshift Ai
|
| CVE-2026-9797 | Nov 06, 2026 |
Keycloak Admin Privilege Escalation via JWKS Manipulation (CVE-2026-9797)A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources. |
Build Keycloak
|
| CVE-2026-97848 | Nov 06, 2026 |
Keycloak JSON Mapper Token Sanitization Bypass (Role Injection)A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97367 | Nov 06, 2026 |
Keycloak Account REST API Session Hijack via Token ManipulationA flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96547 | Nov 06, 2026 |
Keycloak DCR Claim Name Restriction Bypass (Privilege Escalation)A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96460 | Nov 06, 2026 |
Keycloak Token Exchange V2 Unlimited Lifetime VulnerabilityA flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-92856 | Nov 06, 2026 |
Keycloak SAML brokering ProxyRestriction bypass (CVE-2026-92856)A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific security instructions called ProxyRestrictions in the login messages it receives. This allows a user to log into downstream services even when the original identity provider explicitly forbade further sharing of the login session. As a result, users can bypass security boundaries intended to limit where their identity can be used. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-19688 | Nov 06, 2026 |
Keycloak Admin API Token Audience Validation Bypass (CVE-2026-19688)A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96447 | Nov 06, 2026 |
Keycloak TokenManager Stateless Token Validation BypassA flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-109081 | Nov 06, 2026 |
Keycloak DCR endpoint auth bypass leads to role injection DoSA flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS). |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-107124 | Nov 06, 2026 |
Keycloak OIDC Logout Session Fixation via Unvalidated Token HintA flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-121837 | Nov 06, 2026 |
Quarkus REST Data Panache @SecureField Filtering BypassA flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response. |
Exploit Intelligence
Quarkus
|
| CVE-2026-123037 | Nov 06, 2026 |
Ansiblecore User Module Symlink PrivEsc via SSH Key GenerationA flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902. |
Ansible Automation Platform
Ansible Core
Ansible Portal
And others... |
| CVE-2026-112902 | Nov 05, 2026 |
Pillow 12.3.0 TIFF encoder libtiff tag mismatch leads to OOB readPillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiffs definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0. |
|
| CVE-2026-112899 | Nov 05, 2026 |
Pillow 2.3.0-12.3.0 EPS rendering Ghostscript CPU/Disk DoS (fixed in 13.0.0)Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering, allowing resource consumption beyond the configured pixel limit. The amplification depends on the scale selected by the application, not an attacker-controlled scale value. This issue is fixed in version 13.0.0. |
|
| CVE-2026-97847 | Nov 05, 2026 |
Keycloak Protocol Mapper Identity Resolution Bug (CVE-2026-97847)A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97175 | Nov 05, 2026 |
Keycloak idp-auto-link Authenticator Account Takeover via Unverified EmailA flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97174 | Nov 05, 2026 |
Keycloak CIBA sub parameter injection leads to token substitutionA flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-96453 | Nov 05, 2026 |
Keycloak kcadm CLI Truststore Hostname Validation BypassA flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions. |
Amq Broker
Build Keycloak
Jboss Fuse
And others... |
| CVE-2026-93998 | Nov 05, 2026 |
Keycloak SAML Adapter Issuer Mismatch (CVE-2026-93998)A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control. |
Amq Broker
Build Keycloak
Jboss Fuse
And others... |
| CVE-2026-92857 | Nov 05, 2026 |
Keycloak DCR Validation Bypass Allows Token ForgeryKeycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification. |
Build Keycloak
Red Hat Single Sign On
|