Red Hat Keycloak LDAP User Federation Deserialization Vulnerability

A deserialization vulnerability has been identified in the Red Hat build of Keycloak LDAP User Federation provider, specifically in versions 26.2.11 and 26.4.6. This flaw allows an authenticated realm administrator to exploit a malicious LDAP server configuration, leading to the deserialization of untrusted Java objects.

Impact

Exploitation of this vulnerability could allow an attacker to manipulate deserialized objects or data, potentially modifying application data or causing an unexpected state. In some cases, such deserialization vulnerabilities can be leveraged to execute arbitrary code.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.4.6, which is available through the Red Hat Customer Portal. For those using Keycloak 26.2.11, new images are also available on the Customer Portal.