Red Hat Issues Keycloak Image Update Fixing SAML Redirect Binding Signature Bypass
Red Hat has released updated container images for the Red Hat build of Keycloak 26.6.9 and its Operator, addressing a set of security flaws in the single sign-on platform that many organisations run on OpenShift Container Platform. The headline issue is CVE-2026-117691, described by the vendor as a SAML redirect binding signature bypass via percent-encoded parameter names. The advisory, tracked as RHSA-2026:96039 and rated Important by Red Hat, also lists CVE-2026-8674, CVE-2026-86805, CVE-2026-89092 and CVE-2026-95818 among the fixed issues. Affected deployments span the x86_64, aarch64, ppc64le and s390x image variants of rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator. Anyone using Keycloak as a central authentication server for web applications, mobile applications or RESTful services on OpenShift is in scope.
Red Hat has not published a detailed exploitation chain for CVE-2026-117691, and the errata text provides only the flaw's classification. What is stated is that the weakness sits in the handling of the SAML redirect binding, where request parameters are carried in the URL query string and protected by a signature. The vendor's wording points to percent-encoded parameter names being treated inconsistently, producing a signature bypass. No proof-of-concept code, affected configuration detail or attacker telemetry is referenced in the advisory. The remaining four CVEs are listed in the errata without individual descriptions.
Keycloak frequently sits at the centre of an identity architecture, brokering access to downstream applications, so any weakness touching SAML message authenticity carries weight beyond the server itself. A signature bypass in a federation protocol undermines the assumption that a signed authentication message reached the relying party unaltered. Current exploitation signals are low: FIRST EPSS places CVE-2026-117691 at a 0.3% probability of exploitation in the next 30 days, CVE-2026-8674 at 0.3%, CVE-2026-89092 at 0.2%, and CVE-2026-86805 and CVE-2026-95818 both at 0.1%. None of the five CVEs is reported as exploited in the wild, and the fixed images were published on 7 November 2026. Practical exposure is therefore concentrated in clusters still running older image digests.
Attack Surface
Cloud Service, Web Application
Tactics
Credential Access, Defense Evasion, Initial Access
Techniques
- T1606.002 – Forge Web Credentials: SAML Tokens
- T1550.001 – Use Alternate Authentication Material: Application Access Token
- T1190 – Exploit Public-Facing Application
SuperPRO's Threat Countermeasures Procedures
- Redeploy Red Hat build of Keycloak 26.6.9 on x86_64 using the fixed digests from RHSA-2026:96039: rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116 and rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc.
- For non-x86 clusters, pull the matching fixed digests: aarch64 rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288, ppc64le rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21, s390x rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15, plus the corresponding keycloak-rhel9-operator digests.
- Update the Operator subscription to the fixed bundle rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead so the Operator does not reconcile Keycloak pods back to a vulnerable image.
- Inventory running workloads by digest before and after the change with 'oc get pods -A -o jsonpath="{..imageID}" | tr " " "n" | grep rhbk/keycloak' to confirm no pod is still pinned to a pre-errata image.
- Follow the vendor's pre-upgrade instruction in RHSA-2026:96039 and back up the Keycloak realm configuration, the backing database and database settings before rolling the new images.
- Add an ingress or reverse-proxy rule in front of the Keycloak SAML endpoints (/realms/*/protocol/saml) that logs and alerts on redirect-binding query strings where the parameter names SAMLRequest, SAMLResponse, SigAlg or Signature are percent-encoded rather than sent literally, which is the input pattern named in CVE-2026-117691.
- Review Keycloak admin and authentication event logs for the period before the update for SAML logins with mismatched or unexpected issuer and signature metadata, and rotate realm signing keys for any SAML client whose assertions cannot be accounted for.
