StackRadarChart IndexLive demo

CVE-2026-4636

High

Advisory

Published 2 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.003; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 23; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 2 of 2; affected packages

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
keycloak-servicesmaven	14.0.0, 17.0.1, 19.0.3, 20.0.1+14 more	26.5.7	20
keycloakbitnami	26.5.0-1	26.2.1	1

OSV records: BIT-keycloak-2026-4636 GHSA-f2hx-5fx3-hmcv

Charts affected

23 by stars

Chart

Latest

Affected images

Radar Score

keycloakcodecentric

1 of 3 See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	26.5.7

Open the chart page →

7,713

musicocielmusicociel

1 of 3 See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-services@23.0.3	26.5.7

Open the chart page →

4,406

cosmocosmo-platform

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/keycloak :0.13.0	b37408461b9b	keycloak-services@26.5.4	26.5.7

Open the chart page →

28,839

1 of 12 See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-services@20.0.5	26.5.7

Open the chart page →

37,373

keycloakaccount-service

1 of 2 See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	26.5.7

Open the chart page →

7,713

arlas-aiasarlas-stack

1 of 22 See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	keycloak-services@26.3.3	26.5.7

Open the chart page →

40,238

idmassist-iot-identity-manager

1 of 2 See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-services@19.0.3	26.5.7

Open the chart page →

13,352

keycloakbarravar

1 of 1 See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-services@24.0.3	26.5.7

Open the chart page →

2,381

damap-chartdamap

1 of 5 See more

damap-chart damap 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	keycloak-services@26.4.7	26.5.7

Open the chart page →

13,936

drogue-cloud-coredrogue-iot

1 of 22 See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	26.5.7

Open the chart page →

55,666

drogue-cloud-twindrogue-iot

1 of 8 See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	26.5.7

Open the chart page →

6,915

opencloudjacobcolvin

1 of 13 See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-services@26.1.4	26.5.7

Open the chart page →

45,239

keycloakmt190502

1 of 3 See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	keycloak-services@26.5.6	26.5.7

Open the chart page →

2,901

1 of 29 See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-services@24.0.4	26.5.7

Open the chart page →

15,369

keycloakpascaliske

1 of 1 See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-services@26.0.7	26.5.7

Open the chart page →

2,097

keycloaksb-helm-charts

1 of 2 See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-services@26.0.6	26.5.7

Open the chart page →

2,590

keycloaksikalabs

1 of 1 See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	keycloak-services@26.3.3	26.5.7

Open the chart page →

1,690

simple-keycloaksikalabs

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-services@20.0.1	26.5.7

Open the chart page →

6,443

wonder-mesh-netstrrl-helm

1 of 3 See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-services@26.0.8	26.5.7

Open the chart page →

5,063

opencloudunxwares

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-services@26.1.4	26.5.7

Open the chart page →

45,239

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-services@14.0.0	26.5.7

Open the chart page →

28,605

keycloakwiremind

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	keycloak@26.5.0-1 keycloak-services@26.5.0	26.2.1 26.5.7

Open the chart page →

7,624

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-4636.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-services@20.0.3	26.5.7

Open the chart page →

6,016

Container images carrying it

20 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-services@26.1.4	26.5.7	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	26.5.7	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	26.5.7	2
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-services@19.0.3	26.5.7	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-services@20.0.5	26.5.7	1
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-services@24.0.4	26.5.7	1
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	keycloak-services@26.3.3	26.5.7	1
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	keycloak@26.5.0-1 keycloak-services@26.5.0	26.2.1 26.5.7	1
ghcr.io/wundergraph/cosmo/keycloak :0.13.0	b37408461b9b	keycloak-services@26.5.4	26.5.7	1
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-services@26.0.8	26.5.7	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-services@14.0.0	26.5.7	1
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-services@26.0.7	26.5.7	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-services@24.0.3	26.5.7	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-services@23.0.3	26.5.7	1
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	keycloak-services@26.3.3	26.5.7	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-services@20.0.1	26.5.7	1
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	keycloak-services@26.5.6	26.5.7	1
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	keycloak-services@26.4.7	26.5.7	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-services@26.0.6	26.5.7	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-services@20.0.3	26.5.7	1