This image carries significant risk; production deployment is highly discouraged without strict compensating controls. Attackers could exploit vulnerabilities like CVE-2026-39852 to bypass authorization, or CVE-2026-33870 for request smuggling, potentially leading to unauthorized access to administrative functions or other severe impacts. While the Keycloak community image is popular and immutable by digest, the presence of these 72 exposed vulnerabilities, including one rated 7.1 and 7 others at 6.0 or higher, requires careful consideration. Remediation efforts should prioritize these high-impact findings before production use.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-22020 | HIGH7.1 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | — | Directly Exposed |
| CVE-2026-39852 | MEDIUM6.97 | io.quarkus:quarkus-vertx-http 3.33.1 fixed in 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1 | <0.1% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-22801 | MEDIUM6.63 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.1.132.Final, 4.2.10.Final | <0.1% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-33871 | MEDIUM6.38 | io.netty:netty-codec-http2 4.1.130.Final fixed in 4.1.132.Final, 4.2.11.Final | <0.1% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-5588 | MEDIUM6.38 | org.bouncycastle:bcpkix-jdk18on 1.83 fixed in 1.84 | <0.1% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2025-66293 | MEDIUM6.03 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-22695 | MEDIUM6.03 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nspr 4.36.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nss 3.112.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nss-softokn 3.112.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nss-softokn-freebl 3.112.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nss-sysinit 3.112.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-7531 | MEDIUM5.52 | nss-util 3.112.0-8.el9_4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-0636 | MEDIUM5.52 | org.bouncycastle:bcprov-jdk18on 1.83 fixed in 1.84 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-59250 | MEDIUM5.5 | com.microsoft.sqlserver:mssql-jdbc 13.2.1 fixed in 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11 | <0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-64506 | MEDIUM5.18 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-2100 | MEDIUM5.1 | p11-kit-trust 0.25.3-3.el9_5 No fix yet | <0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-5598 | MEDIUM5.1 | org.bouncycastle:bcprov-jdk18on 1.83 fixed in 1.84 | <0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42198 | MEDIUM5.1 | org.postgresql:postgresql 42.7.10 fixed in 42.7.11 | <0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-5435 | MEDIUM5.02 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-13151 | MEDIUM5.02 | libtasn1 4.16.0-9.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nspr 4.36.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nss 3.112.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nss-softokn 3.112.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nss-softokn-freebl 3.112.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nss-sysinit 3.112.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2020-12413 | MEDIUM5.02 | nss-util 3.112.0-8.el9_4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | MEDIUM4.67 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libgcc 11.5.0-11.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-0232 | MEDIUM4.67 | sqlite-libs 3.34.1-9.el9_7 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | MEDIUM4.67 | zlib 1.2.11-40.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-7500 | MEDIUM4.59 | org.keycloak:keycloak-services 26.6.1 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-22693 | MEDIUM4.5 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-6860 | MEDIUM4.5 | io.vertx:vertx-core 4.5.25 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-28164 | MEDIUM4.25 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-25646 | MEDIUM4.13 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-33636 | LOW3.88 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-26740 | LOW3.83 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-33416 | LOW3.83 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-41254 | LOW3.83 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-64505 | LOW3.74 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-34757 | LOW3.74 | java-21-openjdk-headless 1:21.0.11.0.10-2.el9 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc-common 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc-langpack-en 2.34-231.el9_7.10 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-70873 | LOW2.8 | sqlite-libs 3.34.1-9.el9_7 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-41409 | LOW2.29 | pcre2 10.40-6.el9 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2022-41409 | LOW2.29 | pcre2-syntax 10.40-6.el9 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-5278 | LOW2.24 | coreutils-single 8.32-39.el9 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | NONE0 | ncurses-base 6.2-12.20210508.el9 No fix yet | <0.1% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | ncurses-libs 6.2-12.20210508.el9 No fix yet | <0.1% Theoretical Threat | Not Applicable |
| CVE-2026-42583 | NONE0 | io.netty:netty-codec 4.1.130.Final fixed in 4.1.133.Final | — | Not Applicable |
| CVE-2026-42579 | NONE0 | io.netty:netty-codec-dns 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42584 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42587 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-41417 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.1.133.Final, 4.2.13.Final | <0.1% Theoretical Threat | Not Applicable |
| CVE-2026-42580 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42581 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42585 | NONE0 | io.netty:netty-codec-http 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42587 | NONE0 | io.netty:netty-codec-http2 4.1.130.Final fixed in 4.2.13.Final, 4.1.133.Final | — | Not Applicable |
| CVE-2026-42578 | NONE0 | io.netty:netty-handler-proxy 4.1.130.Final fixed in 4.1.133.Final, 4.2.13.Final | — | Not Applicable |
| CVE-2026-42577 | NONE0 | io.netty:netty-transport-native-epoll 4.1.130.Final fixed in 4.2.13.Final | — | Not Applicable |