Skip to content
Advisories.
Red HatCVE-2026-16443

Red Hat Data Grid 8: improper signature check

High7.4CVE-2026-16443 · Published Aug 5, 2026 · updated Aug 10, 2026

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Data Grid 8
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.4.14
Product
all versionsNo fix yet
all versionsNo fix yet
Red Hat build of Keycloak 26.6.5
Product
all versionsNo fix yet
all versionsNo fix yet
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-347

More Red Hat advisories

All Red Hat
Advisory
Red Hat Enterprise Linux 10: integer overflow
Low2.2Aug 5
Red Hat RPM: buffer overflow
Medium5.5Aug 5
Red Hat OpenShift Container Platform 4: authentication bypass
Medium6.5Aug 5
Red Hat SAML broker: origin validation error
High7.4Aug 5
Red Hat Keycloak: type confusion
High8.8Aug 5
Red Hat LDAP storage provider of Keycloak: improper privilege management
Medium5.4Aug 5

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.