Vulnerability in Red Hat Build of Keycloak

[ Description ]Official description

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3577

  Keycloak: Vulnerability allows gaining administrator rights Translated from German

  CVE-2026-107121CVE-2026-96448

[ References ]References

• access.redhat.com/security/cve/CVE-2026-107121
• bugzilla.redhat.com/show_bug.cgi