Important: Keycloak security update
Type/Severity
NetEye Product Security has rated this update as having a high security impact.
Topic
An update for the keycloak packages is now available for NetEye 4.
Security Fix for NetEye 4.50:
26.8.1_neteye1.47.2-1
CVEs
- CVE-2026-94000
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVE-2026-94001
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - CVE-2026-97177
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVE-2026-94215
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L - CVE-2026-97311
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVE-2026-107121
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - CVE-2026-15943
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N - CVE-2026-82968
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - CVE-2026-18569
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVE-2026-96446
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - CVE-2026-97846
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-94218
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - CVE-2026-96445
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVE-2026-95503
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVE-2026-103884
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - CVE-2026-94213
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVE-2026-94217
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - CVE-2026-101333
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - CVE-2026-91777
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Most of the 19 CVEs are Missing/Incorrect Authorization flaws in the Admin REST API and Fine-Grained Admin Permissions (FGAP) v2: they let a delegated administrator with limited privileges escalate to full realm control and read or modify users, roles and client configurations across realm boundaries. The other CVEs allow permanent account takeover via social-identity-provider account linking in identity brokering, bypass of mTLS certificate binding in Standard Token Exchange, a Conditional OTP bypass behind untrusted proxies, 2FA-setup enforcement bypass, Kerberos KDC spoofing, path traversal via a client-supplied X.509 CRL Distribution Point, SMTP STARTTLS downgrade to plaintext, acceptance of forged unsigned backchannel-logout tokens, and two denial-of-service flaws (unbounded metric cardinality and jackson-databind). Together, these CVEs can lead to privilege escalation, account takeover, exposure of credentials and user data, or denial of service.
Moreover, this update hardens Keycloak against fifteen further weaknesses without a CVE identifier. The most severe are two SAML issues: a signature-confusion flaw in the identity broker’s HTTP-Redirect binding that allows an unauthenticated attacker to log in as an arbitrary user, and unauthenticated session termination via crafted LogoutRequest messages. Remaining fixes cover FGAP v2 role injection, reusable organization invitation links, username enumeration via response timing, credentials recorded in logs, and cache-invalidation and connection-pool leaks, among others.
Affected Products
All NetEye 4.x versions >= 4.38
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/keycloak/keycloak/releases/tag/26.8.1
- https://github.com/advisories/GHSA-3g7j-6fqv-v2q4
- https://github.com/advisories/GHSA-p353-3p63-7h28
- https://github.com/advisories/GHSA-pgx8-hgcr-q6rq
- https://github.com/advisories/GHSA-v5q7-f26g-qxgh
- https://github.com/advisories/GHSA-rc25-9gwp-h85r
- https://github.com/advisories/GHSA-4276-jw29-xwhr
- https://github.com/advisories/GHSA-rpfh-mgxm-c6hc
- https://github.com/advisories/GHSA-2w6p-j7xq-6p7v
- https://github.com/advisories/GHSA-pcf4-9g97-7cpf
- https://github.com/advisories/GHSA-j24v-wv3r-fjch
- https://github.com/advisories/GHSA-f7cv-8449-mr73
- https://github.com/advisories/GHSA-rm49-qjx7-5qm5
- https://github.com/advisories/GHSA-jj9w-64w4-2wcx
- https://github.com/advisories/GHSA-35j3-ccrv-pgvj
- https://github.com/advisories/GHSA-xfh5-8fx4-3crm
- https://github.com/advisories/GHSA-7238-mjjf-8jj4
- https://github.com/advisories/GHSA-2cpw-3v2x-mh42
- https://github.com/advisories/GHSA-5fh4-qp8q-2wxm
- https://github.com/advisories/GHSA-cxp5-3px4-pw24
Patrick Harasser
Author
