Disclaimer: Some of the CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available. Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: CVEs Most of the 19 CVEs are Missing/Incorrect Authorization flaws in the Admin REST API and Fine-Grained Admin Permissions (FGAP) v2:…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: Summary This Keycloak update (version 26.8.0) resolves several security issues identified in upstream Keycloak, including those fixed in upstream release 26.7.5:…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.49: Summary This Keycloak update (version 26.7.4) resolves several security issues identified in upstream Keycloak: For details on how to apply this…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.49 Summary This Keycloak update (version 26.7.3) fixes 20 security issues found during internal review. None of them are rated Critical for running…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a critical security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.49 Summary This vulnerability, tracked as CVE-2026-18963 (CVSS 9.1, Critical), affects the reset-credentials authentication flow in Keycloak. Due to improper state validation, an…
Read MoreImportant: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.48 Summary This vulnerability allows an attacker with a valid signed SAML assertion to inject a malicious encrypted assertion into an unsigned SAML…
Read MoreHi everyone! Today I’d like to share with you an investigation we undertook related to ingesting Open Telemetry data in Elasticsearch, while maintaining tenant segregation from start to end. The Scenario Let’s imagine we have multiple customers, where in this case “multiple” may be well in the order of hundreds, who would like to send…
Read MoreWhile working on some internal tools, I needed secure access to a few PHP pages and virtual directories resources that, by default, didn’t have any built-in access control. Since NetEye already uses Keycloak as its authentication system, I decided to leverage it to handle login and user validation. This way I could avoid reinventing the…
Read MoreIn this article I’ll guide you step-by-step through configuring Keycloak to connect to an LDAP server using a secure LDAPS (SSL/TLS) connection, with support for certificates signed by either internal or self-signed Certificate Authorities. This is especially useful in enterprise environments using Active Directory or a centralized LDAP server. This configuration is particularly relevant for…
Read More