Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
Keycloak could expose data due to Bouncy Castle issue
published 5 days ago
Summary
The Keycloak software from cleanstart uses an older version of the Bouncy Castle library for Java. This older library can allow attackers to read information that should be kept secret. Update Keycloak to a version that includes the latest Bouncy Castle library or apply the vendor’s recommended patch.
What to do
- Update cleanstart keycloak to version 26.4.13-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | keycloak |
< 26.4.13-r1 Fix: upgrade to 26.4.13-r1
|
Original advisory text
In Bouncy Castle for Java before 1
Security vulnerability affects the keycloak package. In Bouncy Castle for Java before 1.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-JO96911 · OSV
Track software like this
Free during beta