Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Keycloak and Kogito apps could let attackers bypass security

published 1 month ago
Summary

Versions of Keycloak (26.4.7‑r3, 26.5.0‑r0, 26.5.0‑r2) and Kogito‑apps (10.1.0‑r0) contain a flaw that might allow unauthorized users to gain access or perform actions they shouldn’t. The issue is fixed in newer releases, so upgrade to the latest versions as soon as possible.

What to do
  • Update cleanstart keycloak to version 26.4.7-r3.
  • Update cleanstart keycloak to version 26.5.0-r0.
  • Update cleanstart keycloak to version 26.5.0-r2.
  • Update cleanstart kogito-apps to version 10.1.0-r0.
  • Update keycloak to version 26.4.7-r3.
  • Update keycloak to version 26.5.0-r0.
  • Update keycloak to version 26.5.0-r2.
  • Update kogito-apps to version 10.1.0-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart keycloak < 26.4.7-r3
< 26.5.0-r0
< 26.5.0-r2
Fix: upgrade to 26.4.7-r3
CleanStart cleanstart kogito-apps < 10.1.0-r0
Fix: upgrade to 10.1.0-r0
CleanStart – keycloak < 26.4.7-r3
< 26.5.0-r0
< 26.5.0-r2
Fix: upgrade to 26.4.7-r3
CleanStart – kogito-apps < 10.1.0-r0
Fix: upgrade to 10.1.0-r0
Original advisory text
Security fix for GHSA-5rfx-cp42-p624 applied in: keycloak 26.4.7-r3, keycloak 26.5.0-r0, keycloak 26.5.0-r2, kogito-apps 10.1.0-r0
GHSA-5rfx-cp42-p624 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Severity
5.9 Medium
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-VG40041 · OSV
Track software like this
Free during beta