Important: Keycloak security update
Type/Severity
NetEye Product Security has rated this update as having a high security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.49
26.7.3_neteye1.46.1-1
Summary
This Keycloak update (version 26.7.3) fixes 20 security issues found during internal review. None of them are rated Critical for running systems. The two most serious, CVE-2026-18215 and CVE-2026-18214 (CVSS 8.1), could let an external login provider (Microsoft or Google) bypass the organization/tenant restriction configured for it, potentially letting an account from outside the allowed company or domain log in. Another issue, CVE-2026-18571 (CVSS 7.2), could let a delegated administrator assign a user to groups they aren’t supposed to manage. The remaining issues are lower-severity gaps in permission checks and edge cases in login/authorization handling, with limited practical impact on their own. There is no evidence of active exploitation of any of these issues.
For details on how to apply this update, refer to the NetEye Update Section in the User Guide.
Affected Products
All NetEye 4.x versions >= 4.38.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://www.keycloak.org/2026/08/keycloak-2673-released
- https://github.com/keycloak/keycloak/issues/51287
- https://github.com/keycloak/keycloak/issues/51282
- https://github.com/keycloak/keycloak/issues/51378
Davide Zeni
Author
