Red Hat Patches Four Keycloak IAM Flaws

Red Hat published advisories for four Keycloak CVEs today. None appear on CISA’s Known Exploited Vulnerabilities catalog.

Two are rated medium severity. CVE-2026-94215 (CVSS 5.5) is in the Admin REST API: the per-request in-memory cache resolves clients by client_id in a way Red Hat’s advisory describes as flawed. Red Hat did not fully disclose scope or exploitation conditions. CVE-2026-94213 (CVSS 4.9) is in Authorization Services: the policy evaluation endpoint, used by administrators to test authorization policies, can surface permission information beyond what is intended. Advisory.

Two are rated low severity. CVE-2026-94217 (CVSS 3.5) is in the User-Managed Access (UMA) implementation: when two users own separate resources and a single permission ticket covers both, the authorization token endpoint produces unexpected behavior at that boundary. Advisory. CVE-2026-94218 (CVSS 3.1) is in session management: if an administrator enforces a stronger authentication flow after a session token is issued, sessions issued before that change bypass the new requirement. Advisory.

Each advisory links to patched versions. For deployments with Admin REST API or Authorization Services endpoints reachable from untrusted networks, CVE-2026-94215 and CVE-2026-94213 are the higher-priority fixes. The low-severity items can follow in the next maintenance window.

Related coverage: REDCap Patches CVSS 9.8 Unauth RCE via Survey Route, Icinga 2 Patches CVSS 9.8 Auth Bypass and Stack Overflow, CVE-2026-90895: MISP CLI Exposes Auth Creds, Bypasses ACLs.