Keycloak analyzed · Free
Every Keycloak image.
Scanned every day.
Leavory scans every tag of the official Keycloak image every day and checks it against CISA KEV, the catalog of vulnerabilities attackers already exploit. See which versions carry an active exploit, and Leavory at work on real data.
Findings
The older the version, the more exposed.
Keycloak decides who signs in to everything behind it, so a flaw in its image reaches every system that trusts it. From the oldest version still on the registry to the current one, this is how the official image changed.
Vulnerabilities, 5.0.0 → 26.8.0
Critical, 5.0.0 → 26.8.0
Actively exploited (CISA KEV), 5.0.0 → 26.8.0
282 tags and 133 versions of quay.io/keycloak/keycloak,
snapshot of October 4, 2026. The live numbers are in the hub.
By version
Up to 22.0.4, every version carries an active exploit.
Remote code execution in 5.x to 8.x, privilege escalation to root from 7.0.1 to 22.0.4, and HTTP/2 Rapid Reset up to 20.0.5. From 26.1.2 on, no version has a CVE from CISA KEV.
quay.io/keycloak/keycloak
Latest release of each line · October 4, 2026| Version | Critical | High | Exploited (KEV) | Status |
|---|---|---|---|---|
| 5.0.0 | 96 | 589 | 5 | 5 exploited |
| 10.0.2 | 19 | 292 | 6 | 6 exploited |
| 15.1.1 | 22 | 274 | 4 | 4 exploited |
| 20.0.5 | 5 | 210 | 3 | 3 exploited |
| 22.0.5 | 8 | 115 | 1 | 1 exploited |
| 24.0.5 | 6 | 92 | 0 | No exploited CVE |
| 26.0.8 | 7 | 88 | 0 | Account takeover |
| 26.6.4 | 5 | 38 | 0 | Account takeover |
| 26.8.0 | 0 | 6 | 0 | No exploited CVE |
CVE-2026-18963: account takeover without a password
A critical flaw in Keycloak's own code (CVSS 9.1): the credential reset flow can be bypassed to take over any account, admins included. It affects 48 versions, from 26.0.0 to 26.7.1. The first fixed community image is 26.7.2.
What to do
Check what is running.
The version in your docs or your configuration repository is not the one that counts. The image running in each environment is.
-
Up to 22.0.4: treat it as an incident
These versions carry vulnerabilities attackers already use, including remote code execution and privilege escalation to root.
-
26.0.0 to 26.7.1: update now
They carry CVE-2026-18963, the account takeover without authentication.
-
Aim for 26.8.0
Or at least 26.7.5. Big jumps between major versions need tests for themes, extensions (SPIs), and the database migration.
-
Pin by digest and rebuild often
The same version is republished with an updated base system. A tag that never moves gets older without changing its number.
Run the same check on the images your teams run. Try Image Scan
Questions
About this analysis.
Why Keycloak?
It is one of the most used open-source identity platforms: single sign-on, OpenID Connect, OAuth 2.0, SAML, and federation with LDAP and Active Directory. Because it controls who gets in, an outdated image is not a detail: it is the lock on the front door.
How was it analyzed?
Every active tag of the official community image was pulled (linux/amd64), its SBOM generated and scanned with Trivy for critical, high, medium, and low vulnerabilities, and the image discarded. Leavory syncs CISA KEV daily and rescans from the saved SBOM every day, without pulling the image again.
Are these numbers live?
No. This page shows the snapshot of October 4, 2026; new advisories can change it. The analysis in the hub is updated every day.
Do I need an account?
Yes, a free Leavory account with a work email. The same account gives you Image Scan and Security Gate.
Can I check my own images?
Yes. Image Scan watches up to five of your images for free, public or private, with a new scan every day.
See Leavory in action.
Tell us which platform you use, and an engineer, not a sales bot, will reach out to schedule a demo.