quay.io/keycloak/keycloak:26.7.0
Base OS: redhat 9.8clean
Patched Image
ghcr.io/verity-org/keycloak/keycloak:26.7.0
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/keycloak/keycloak:26.7.0
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/keycloak/keycloak:26.7.0 \ --owner verity-org
Before patching
Found 65 vulnerabilities — none have upstream fixes available.
9 HIGH34 MEDIUM22 LOW
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2025-59250HIGH
- Package
- com.microsoft.sqlserver:mssql-jdbc
- Installed
- 13.2.1
- Fixed
- 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54516MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54517MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4, 3.1.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2026-54518MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.21.2
- Fixed
- 2.21.4
- CVE-2026-45292MEDIUM
- Package
- io.opentelemetry:opentelemetry-api
- Installed
- 1.57.0
- Fixed
- 1.62.0
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2025-59250 | com.microsoft.sqlserver:mssql-jdbc | 13.2.1 | 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11 | HIGH |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54516 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54517 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2026-54518 | com.fasterxml.jackson.core:jackson-databind | 2.21.2 | 2.21.4 | MEDIUM |
| CVE-2026-45292 | io.opentelemetry:opentelemetry-api | 1.57.0 | 1.62.0 | MEDIUM |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2025-66293HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22020HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-25646HIGH
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-54369HIGH
- Package
- libacl
- Installed
- 2.3.1-4.el9
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc-common
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5435MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-5928MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2026-6238MEDIUM
- Package
- glibc-langpack-en
- Installed
- 2.34-272.el9_8
- Fixed
- CVE-2025-28164MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2025-64505MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2025-64506MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22693MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22695MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-22801MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-33416MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-33636MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-34757MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-41254MEDIUM
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2026-54370MEDIUM
- Package
- libacl
- Installed
- 2.3.1-4.el9
- Fixed
- CVE-2026-54371MEDIUM
- Package
- libattr
- Installed
- 2.5.1-3.el9
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit-trust
- Installed
- 0.26.2-1.el9
- Fixed
- CVE-2026-5958MEDIUM
- Package
- sed
- Installed
- 4.8-10.el9
- Fixed
- CVE-2026-27171LOW
- Package
- java-21-openjdk-headless
- Installed
- 1:21.0.11.0.10-2.el9
- Fixed
- CVE-2021-46195LOW
- Package
- libgcc
- Installed
- 11.5.0-14.el9
- Fixed
- CVE-2022-27943LOW
- Package
- libgcc
- Installed
- 11.5.0-14.el9
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-base
- Installed
- 6.2-12.20210508.el9
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-libs
- Installed
- 6.2-12.20210508.el9
- Fixed
- CVE-2020-12413LOW
- Package
- nspr
- Installed
- 4.36.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nspr
- Installed
- 4.36.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-softokn
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-softokn
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-softokn-freebl
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-softokn-freebl
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-sysinit
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-sysinit
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2020-12413LOW
- Package
- nss-util
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2024-7531LOW
- Package
- nss-util
- Installed
- 3.112.0-8.el9_4
- Fixed
- CVE-2022-41409LOW
- Package
- pcre2
- Installed
- 10.40-6.el9
- Fixed
- CVE-2022-41409LOW
- Package
- pcre2-syntax
- Installed
- 10.40-6.el9
- Fixed
- CVE-2024-0232LOW
- Package
- sqlite-libs
- Installed
- 3.34.1-10.el9_8
- Fixed
- CVE-2025-70873LOW
- Package
- sqlite-libs
- Installed
- 3.34.1-10.el9_8
- Fixed
- CVE-2026-27171LOW
- Package
- zlib
- Installed
- 1.2.11-40.el9
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2025-66293 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-22020 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-25646 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | HIGH | |
| CVE-2026-54369 | libacl | 2.3.1-4.el9 | HIGH | |
| CVE-2026-5435 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5435 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc-common | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5435 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-5928 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2026-6238 | glibc-langpack-en | 2.34-272.el9_8 | MEDIUM | |
| CVE-2025-28164 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2025-64505 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2025-64506 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22693 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22695 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-22801 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-33416 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-33636 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-34757 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-41254 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | MEDIUM | |
| CVE-2026-54370 | libacl | 2.3.1-4.el9 | MEDIUM | |
| CVE-2026-54371 | libattr | 2.5.1-3.el9 | MEDIUM | |
| CVE-2026-13757 | p11-kit-trust | 0.26.2-1.el9 | MEDIUM | |
| CVE-2026-5958 | sed | 4.8-10.el9 | MEDIUM | |
| CVE-2026-27171 | java-21-openjdk-headless | 1:21.0.11.0.10-2.el9 | LOW | |
| CVE-2021-46195 | libgcc | 11.5.0-14.el9 | LOW | |
| CVE-2022-27943 | libgcc | 11.5.0-14.el9 | LOW | |
| CVE-2023-50495 | ncurses-base | 6.2-12.20210508.el9 | LOW | |
| CVE-2023-50495 | ncurses-libs | 6.2-12.20210508.el9 | LOW | |
| CVE-2020-12413 | nspr | 4.36.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nspr | 4.36.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-softokn | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-softokn | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-softokn-freebl | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-softokn-freebl | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-sysinit | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-sysinit | 3.112.0-8.el9_4 | LOW | |
| CVE-2020-12413 | nss-util | 3.112.0-8.el9_4 | LOW | |
| CVE-2024-7531 | nss-util | 3.112.0-8.el9_4 | LOW | |
| CVE-2022-41409 | pcre2 | 10.40-6.el9 | LOW | |
| CVE-2022-41409 | pcre2-syntax | 10.40-6.el9 | LOW | |
| CVE-2024-0232 | sqlite-libs | 3.34.1-10.el9_8 | LOW | |
| CVE-2025-70873 | sqlite-libs | 3.34.1-10.el9_8 | LOW | |
| CVE-2026-27171 | zlib | 1.2.11-40.el9 | LOW |
Original image reference
quay.io/keycloak/keycloak:26.7.0