kadet-hub
Image security report: keycloak recipe
keycloak: grade D, 70 findings, one per advisory and package, in the 1 image of version 1.0.1: CRITICAL 0, HIGH 4, MEDIUM 38, LOW 28, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
quay.io/keycloak/keycloak:26.8.1@sha256:3f3c5f8e03c614774b4bd9173b88391fefa4153bfc010d8012d59ad825377332
CRITICAL 0, HIGH 4, MEDIUM 38, LOW 28, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-102554 | HIGH | com.google.guava:guava | 33.6.0-jre | 33.7.2 |
| CVE-2026-119373 | HIGH | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-119586 | HIGH | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-91403 | HIGH | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2025-28164 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2025-64505 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2025-64506 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-102010 | MEDIUM | libgcc | 11.5.0-14.el9 | |
| CVE-2026-114690 | MEDIUM | libgcc | 11.5.0-14.el9 | |
| CVE-2026-114691 | MEDIUM | libgcc | 11.5.0-14.el9 | |
| CVE-2026-118259 | MEDIUM | io.opentelemetry:opentelemetry-api | 1.62.0 | 1.67.0 |
| CVE-2026-119210 | MEDIUM | org.mariadb.jdbc:mariadb-java-client | 3.5.10 | 3.3.7, 3.4.5, 3.5.11 |
| CVE-2026-119276 | MEDIUM | org.mariadb.jdbc:mariadb-java-client | 3.5.10 | 3.3.7, 3.4.5, 3.5.11 |
| CVE-2026-119281 | MEDIUM | org.mariadb.jdbc:mariadb-java-client | 3.5.10 | 3.3.7, 3.4.5, 3.5.11 |
| CVE-2026-119378 | MEDIUM | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-119591 | MEDIUM | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-22693 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-34757 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-40930 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-46675 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-49919 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-50812 | MEDIUM | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-56391 | MEDIUM | coreutils-single | 8.32-41.el9_8.1 | |
| CVE-2026-5958 | MEDIUM | sed | 4.8-10.el9 | |
| CVE-2026-84243 | MEDIUM | glibc | 2.34-283.el9_8 | |
| CVE-2026-84243 | MEDIUM | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-84243 | MEDIUM | glibc-langpack-en | 2.34-283.el9_8 | |
| CVE-2026-8674 | MEDIUM | glibc | 2.34-283.el9_8 | |
| CVE-2026-8674 | MEDIUM | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-8674 | MEDIUM | glibc-langpack-en | 2.34-283.el9_8 | |
| CVE-2026-86805 | MEDIUM | glibc | 2.34-283.el9_8 | |
| CVE-2026-86805 | MEDIUM | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-86805 | MEDIUM | glibc-langpack-en | 2.34-283.el9_8 | |
| CVE-2026-89092 | MEDIUM | glibc | 2.34-283.el9_8 | |
| CVE-2026-89092 | MEDIUM | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-89092 | MEDIUM | glibc-langpack-en | 2.34-283.el9_8 | |
| CVE-2026-91382 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-95512 | MEDIUM | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-95619 | MEDIUM | libgcc | 11.5.0-14.el9 | |
| CVE-2026-95818 | MEDIUM | glibc | 2.34-283.el9_8 | |
| CVE-2026-95818 | MEDIUM | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-95818 | MEDIUM | glibc-langpack-en | 2.34-283.el9_8 | |
| CVE-2020-12413 | LOW | nspr | 4.39.0-5.el9_6 | |
| CVE-2020-12413 | LOW | nss | 3.124.0-5.el9_6 | |
| CVE-2020-12413 | LOW | nss-softokn | 3.124.0-5.el9_6 | |
| CVE-2020-12413 | LOW | nss-softokn-freebl | 3.124.0-5.el9_6 | |
| CVE-2020-12413 | LOW | nss-sysinit | 3.124.0-5.el9_6 | |
| CVE-2020-12413 | LOW | nss-util | 3.124.0-5.el9_6 | |
| CVE-2021-46195 | LOW | libgcc | 11.5.0-14.el9 | |
| CVE-2022-27943 | LOW | libgcc | 11.5.0-14.el9 | |
| CVE-2022-41409 | LOW | pcre2 | 10.40-7.el9_8 | |
| CVE-2022-41409 | LOW | pcre2-syntax | 10.40-7.el9_8 | |
| CVE-2023-50495 | LOW | ncurses-base | 6.2-12.20210508.el9 | |
| CVE-2023-50495 | LOW | ncurses-libs | 6.2-12.20210508.el9 | |
| CVE-2024-0232 | LOW | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2024-7531 | LOW | nspr | 4.39.0-5.el9_6 | |
| CVE-2024-7531 | LOW | nss | 3.124.0-5.el9_6 | |
| CVE-2024-7531 | LOW | nss-softokn | 3.124.0-5.el9_6 | |
| CVE-2024-7531 | LOW | nss-softokn-freebl | 3.124.0-5.el9_6 | |
| CVE-2024-7531 | LOW | nss-sysinit | 3.124.0-5.el9_6 | |
| CVE-2024-7531 | LOW | nss-util | 3.124.0-5.el9_6 | |
| CVE-2025-70873 | LOW | sqlite-libs | 3.34.1-11.el9_8 | |
| CVE-2026-115456 | LOW | libgcc | 11.5.0-14.el9 | |
| CVE-2026-119280 | LOW | org.mariadb.jdbc:mariadb-java-client | 3.5.10 | 3.3.7, 3.4.5, 3.5.11 |
| CVE-2026-27171 | LOW | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-27171 | LOW | zlib | 1.2.11-40.el9 | |
| CVE-2026-91409 | LOW | java-21-openjdk-headless | 1:21.0.13.0.9-1.2.el9 | |
| CVE-2026-97399 | LOW | glibc | 2.34-283.el9_8 | |
| CVE-2026-97399 | LOW | glibc-common | 2.34-283.el9_8 | |
| CVE-2026-97399 | LOW | glibc-langpack-en | 2.34-283.el9_8 |