Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Hazelcast, Keycloak, Thingsboard may let attackers bypass security
published 1 month ago
Summary
Older versions of Hazelcast, Keycloak and Thingsboard can be tricked into granting access they shouldn’t. This could let an attacker view or change data without permission. Update to the latest released versions listed for each product to close the gap.
What to do
- Update cleanstart hazelcast to version 5.7.0-r1.
- Update cleanstart keycloak to version 26.3.5-r3.
- Update cleanstart keycloak to version 26.4.2-r0.
- Update cleanstart keycloak to version 26.4.7-r4.
- Update cleanstart keycloak to version 26.5.6-r6.
- Update cleanstart keycloak to version 26.5.7-r1.
- Update cleanstart keycloak to version 26.6.3-r2.
- Update cleanstart thingsboard to version 4.2.2.3-r1.
- Update cleanstart thingsboard to version 4.3.1.3-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | hazelcast |
< 5.7.0-r1 Fix: upgrade to 5.7.0-r1
|
| CleanStart | cleanstart | keycloak |
< 26.3.5-r3 < 26.4.2-r0 < 26.4.7-r4 < 26.5.6-r6 < 26.5.7-r1 < 26.6.3-r2 Fix: upgrade to 26.3.5-r3
|
| CleanStart | cleanstart | thingsboard |
< 4.2.2.3-r1 < 4.3.1.3-r1 Fix: upgrade to 4.2.2.3-r1
|
Original advisory text
Security fix for CVE-2026-48059 applied in: hazelcast 5.7.0-r1, keycloak 26.3.5-r3, keycloak 26.4.2-r0, keycloak 26.4.7-r4, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.3-r2, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1
CVE-2026-48059 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-BD80531 · OSV
Track software like this
Free during beta