Critical keycloak password reset flaw could let unauthenticated attackers take over any account. Swati KhandelwalAug 24, 2026 Vulnerability / Identity Security Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as the CVE Numbering Authority (CNA) for the flaw. It has been classified as a weak password recovery mechanism for a forgotten password (CWE-640). Users of upstream Keycloak are advised to update to version 26.7.2, released August 19, 2026, while customers running Red Hat build of Keycloak (RHBK) should apply the updates shipped for 26.4.15 and 26.6.6. There is no evidence that the flaw has been exploited, and no verified public exploit has been located as of August 24, 2026. Red Hat said in its CVE advisory that the root cause is "improper state validation within the reset-credentials authentication flow," the sequence Keycloak runs when a user requests password recovery. The company assessed the severity as Critical because an unauthenticated remote attacker can exploit the flaw without any user interaction. The defect lies in how the flow's state is managed, according to the Red Hat bug report. An attacker sends a specially crafted request to the reset-credentials endpoint. The authentication session then transitions directly to the password update phase. The action token that Keycloak normally sends via email is never required. Successful exploitation results in a complete account takeover of any user, "including administrative accounts," by resetting their password. Escape researcher Enzo Mongin, writing about a separate Keycloak access-control flaw he disclosed in July, said an attacker who crosses one of the server's boundaries does not stop at Keycloak, and that "they get into everything sitting behind it." Red Hat issued four errata on August 18, 2026 (RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523 and RHSA-2026:56524), covering the standalone server packages and the container images for two RHBK streams. The fixed versions are as follows - * Red Hat build of Keycloak 26.4 is unaffected from operator bundle 26.4.15-1, and from the rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images 26.4-23 * Red Hat build of Keycloak 26.6 is unaffected from operator bundle 26.6.6-1 and from the keycloak-rhel9 and operator containers 26.6-12 * Upstream Keycloak is fixed in 26.7.2 The GitHub advisory for the flaw lists both the affected and the patched versions as unknown, and the CVE record carries only Red Hat product references. The initial CVE record listed Red Hat Single Sign-On 7 as unaffected and the Red Hat JBoss Enterprise Application Platform Expansion Pack as affected. A later revision narrowed the product list, and NVD's display truncates it, so the current status of both is not established. For deployments that cannot be updated immediately, Red Hat has published a temporary mitigation - turn off the "Forgot password" functionality across all realms. In the RHBK administration console, the setting sits under Realm settings, then Login, then Forgot password. Red Hat said the setting must be applied to every realm and that customers should upgrade to a fixed version as soon as possible. CVE-2026-18963 was one of eight CVE identifiers listed as fixed in the Keycloak 26.7.2 release notes. The same release addressed CVE-2026-15571, a predictable account-linking hash that enables account takeover through a malicious OpenID Connect (OIDC) client. Two weeks earlier, on August 5, 2026, Keycloak 26.7.1 shipped fixes for twelve CVEs, including a SAML identity-provider-initiated broker login that bypassed a link-only restriction and a default dynamic client registration policy that allowed role forgery via user property mappers. Separately, Univention said in a post published August 20 that "Nubus is not affected by this issue" because the forgotten-password feature is not activated in its Keycloak deployments. Red Hat credited James Paremain with reporting the flaw. No source addresses whether the fix fully resolves the flaw. Whether every realm with the forgotten-password feature enabled is exploitable, or only certain reset-credentials flow configurations, is not stated by any of the published sources. Found this article interesting? Follow ASMGi on Google News, Twitter and LinkedIn to read more exclusive content ASMGi post.

Red Hat Kubernetes flaw lets unauthenticated attackers access internal cluster services. Incident overview. Red Hat has disclosed a critical Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-66794, residing in the cluster-proxy-addon component of its Kubernetes-based environments. This security flaw enables unauthenticated remote attackers to bypass access controls and interact directly with sensitive internal cluster services that were intended to be unreachable from the outside. The vulnerability was discovered during internal security auditing, and while no specific threat actor attribution has been linked to active exploitation, the nature of the bug poses a significant risk to the integrity of container orchestration platforms. Currently, Red Hat has categorized this as a high-priority issue, urging administrators to verify their deployments. The flaw essentially turns the cluster-proxy-addon into a pivot point, allowing malicious actors to send unauthorized requests to internal APIs or metadata services, effectively breaking the logical isolation of the cluster architecture. Strategic implications. This vulnerability underscores a systemic risk in modern cloud-native architectures where components intended for traffic management can become attack vectors. For organizations relying on Red Hat OpenShift or similar Kubernetes distributions, this represents a failure in network boundary enforcement, potentially leading to unauthorized data exfiltration or privilege escalation. The incident highlights the growing necessity for strict zero-trust network policies that extend deep into the cluster internal fabric. From a compliance perspective, this flaw may trigger incident response mandates under frameworks like GDPR or CCPA if internal data systems were accessible. Businesses must consider the operational disruption required for patching, as Kubernetes infrastructure updates often involve complex deployment pipelines. Ultimately, this highlights that platform-level addons are critical nodes in a security stack that require the same level of rigorous oversight as edge-facing firewalls. Critical insights. Security teams should immediately audit their Kubernetes clusters to determine if the vulnerable cluster-proxy-addon is deployed and assess whether it is exposed to unauthorized networks. The primary technical takeaway is that SSRF vulnerabilities in infrastructure controllers can be leveraged to bypass authentication mechanisms that rely on network location as a primary trust signal. To mitigate this risk, administrators should prioritize applying the official patches provided by Red Hat and implement strict egress filtering to limit the proxy's ability to reach internal management endpoints. Detection strategies should focus on monitoring for anomalous traffic patterns originating from the cluster-proxy service, specifically requests directed at non-standard internal cluster addresses. Best practices include employing network policies to restrict pod-to-pod communication and utilizing admission controllers to prevent the deployment of untrusted components. Moving forward, organizations must integrate infrastructure-as-code scanning to detect misconfigurations in proxy components before they reach production environments.

Red Hat partners with FLock.io to bring federated learning to global enterprise and government ecosystem. Published: August 20, 2026 at 7:03 am Updated: August 20, 2026 at 7:03 am Edited and fact-checked: August 20, 2026 at 7:03 am FLock.io partners with Red Hat to integrate privacy-preserving federated learning into enterprise and government ecosystems, advancing scalable Sovereign AI. Decentralized AI platform FLock.io has entered a strategic partnership with Red Hat, the enterprise open-source solutions provider under IBM, to integrate its privacy-preserving federated learning technology into Red Hat's global ecosystem serving enterprises, government agencies, and public institutions. Under the collaboration, FLock.io's federated learning platform, FL Alliance, will become available on the Red Hat Partner Marketplace. This integration will enable institutional clients to train AI models collaboratively without centralizing or sharing raw data, addressing critical concerns around data privacy, regulatory compliance, and operational sovereignty. Red Hat's infrastructure underpins the technology operations of more than ninety percent of Fortune 500 companies, alongside public-sector bodies including the UK Government, the Government of Ireland, and various US state agencies. The company's technology ecosystem also encompasses major cloud and hardware providers such as NVIDIA, Microsoft, Amazon Web Services, Google Cloud, Intel, and Dell Technologies. Earlier this year, Red Hat deepened its artificial intelligence infrastructure collaboration with NVIDIA, further strengthening its position in the enterprise AI market. FLock.io's cloud-native infrastructure will be incorporated into Red Hat's technology stack as part of the company's broader expansion of sovereign and private cloud capabilities. The partnership aims to establish privacy, control, and transparency as foundational elements of enterprise artificial intelligence deployment, allowing organizations to retain greater authority over their technology and sensitive data. From research to real-world deployment. The collaboration marks a significant evolution in federated learning, shifting the technology from isolated experimental projects toward standardized, scalable implementations suitable for sovereign and enterprise-level use. FLock.io has previously facilitated artificial intelligence deployments in government and healthcare settings, including the development of an AI Centre in Sarawak, Malaysia, and its participation in the World Economic Forum's MINDS project, which supported Britain's National Health Service in exploring privacy-preserving artificial intelligence applications. By combining privacy-preserving AI infrastructure with cloud-native orchestration frameworks, the partnership seeks to reduce barriers for organizations adopting federated learning in production environments. This alignment with established open-source and enterprise tooling ecosystems reflects a broader industry transition toward structured, real-world deployment of privacy-preserving technologies. The chief executive of FLock.io indicated that working within the Red Hat ecosystem represents a meaningful advance in making federated learning accessible within trusted cloud-native environments, reinforcing the company's commitment to developing interoperable, open-source infrastructure that enables developers to deploy AI models without compromising data security. Disclaimer. In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, Metaverse Post suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice. Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance. Alisa Davidson Hot Stories by Alisa Davidson August 20, 2026 by Alisa Davidson August 20, 2026 by Alisa Davidson August 20, 2026 by Alisa Davidson August 19, 2026 by Alisa Davidson August 20, 2026 by Alisa Davidson August 20, 2026 by Alisa Davidson August 20, 2026 by Alisa Davidson August 19, 2026