Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KeycloakClear ×

Keycloak26.7.2SecurityAug 19, 2026

ACTION 2CHECK 6OTHER 14View full analysis

A maintenance release with disclosed security fixes, a cleartext vault-keystore password correction, a Quarkus dependency upgrade, and other bug corrections. The fixes cover account and permission flows, secret handling, and runtime dependencies.

Action needed (2)

securitymediumCVE-2026-59888 and CVE-2026-59889 fixes in jackson-databind
jackson-databind is upgraded to 2.21.5 to address CVE-2026-59888 and CVE-2026-59889. The dependency update ships in this Keycloak release.
securitymediumCVE-2026-45292 OpenTelemetry Java SDK memory allocation correction
CVE-2026-45292 corrects unbounded memory allocation in W3C Baggage Propagation in the OpenTelemetry Java SDK.

Check if affected (6)

securitycriticalCVE-2026-18963 reset-credentials flow bypass correction
Applies if you use the reset-credentials flow.
CVE-2026-18963 corrects an unauthenticated account takeover caused by a bypass in the reset-credentials flow.
securityhighCVE-2026-15571 predictable account-linking hash correction
Applies if you use oidc.
CVE-2026-15571 corrects the predictable account-linking hash that enabled account takeover through a malicious oidc client.
securitymediumCVE-2026-14613 fine-grained admin permissions bypass correction
Applies if you use the admin/fine-grained-permissions API.
CVE-2026-14613 corrects a fine-grained admin permissions bypass through the admin/fine-grained-permissions Role Groups endpoint.
+ 3 more on the release page

Source ↗

Keycloak26.7.1SecurityAug 5, 2026

CHECK 12OTHER 5View full analysis

A maintenance release with security fixes and additional bug fixes. The security fixes require upgrading, and the ordinary bug fixes require no operator action beyond upgrading.

Check if affected (12)

securityhighCVE-2026-15573 unnormalized URI matching in pathmatcher
Applies if you use pathmatcher.
CVE-2026-15573 fixes an authorization bypass caused by unnormalized URI matching in pathmatcher.
securityhighCVE-2026-15572 DCR protocol mapper type-swap policy
Applies if you use DCR.
CVE-2026-15572 fixes a DCR protocol mapper type-swap policy bypass that allowed privilege escalation.
securityhighCVE-2026-16442 SAML broker login restriction
Applies if you use the SAML broker.
CVE-2026-16442 fixes a SAML identity-provider-initiated broker login bypass of the link-only restriction.
+ 9 more on the release page

Source ↗

Keycloak26.7.0SecurityJul 9, 2026

ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
CVE-2026-9796 corrects a time-of-check to time-of-use bypass in admin role renaming that could enable realm-wide escalation from manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
CVE-2026-9689 corrects HTTP parameter pollution in the OIDC redirect URI, which allowed response parameter duplication.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
CVE-2026-9798 corrects a bypass of brute-force account lockout in the CIBA authentication flow.
+ 16 more on the release page

Plan ahead (4)

deprecatedThe V1 API, deprecated
Applies if you use V1.
V1 is deprecated in this release but remains enabled by default for backward compatibility.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
The Require Discoverable Credential option is deprecated in this release.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
The Twitter IDP implementation is deprecated because it uses the old twitter4j library.
+ 1 more on the release page

Source ↗

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
CVE-2026-7500 is addressed in the account API, correcting improper access control on the Keycloak server.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
CVE-2026-8922 is addressed in OIDC token introspection, which now accounts for the realm-level notBefore value.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
CVE-2026-8830 is addressed by adding the missing server-side WebAuthn validations.
+ 12 more on the release page

Source ↗

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
The release fixes the denial-of-service issue caused by a crafted request to the /saml endpoint, identified by CVE-2026-7307.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
The release fixes access token disclosure and implicit flow bypass through forged client data, identified by CVE-2026-7571.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
The release fixes session fixation in the OIDC login flow that could lead to account takeover, identified by CVE-2026-7507.
+ 9 more on the release page

Source ↗

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
Workflows execution no longer bypasses admin permission boundaries from manage-realm to realm-admin.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
Organizations login no longer leaks IdP aliases when no Organization is resolved, preventing IdP and tenant enumeration.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
The SCIM PUT endpoint no longer permits resource modification through a body ID override.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
Token Exchange v1 is deprecated in this release.

Source ↗

Keycloak26.5.7SecurityApr 2, 2026

ACTION 1CHECK 6OTHER 2View full analysis

A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.

Action needed (1)

securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io.vertx/vertx-core static handler component cache that could deny access to static files.

Check if affected (6)

securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
CVE-2026-4634 fixes an application-level denial-of-service issue in scope processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
CVE-2026-4636 fixes a UMA policy resource injection issue that could grant unauthorized permissions across users.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
CVE-2026-3872 fixes a redirect URI validation bypass caused by ..;/ path traversal in the OIDC authentication endpoint.
+ 3 more on the release page

Source ↗

Keycloak26.5.6SecurityMar 19, 2026

CHECK 8OTHER 10View full analysis

A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.

Check if affected (8)

securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration
Applies if you use OIDC Dynamic Client Registration.
Keycloak 26.5.6 fixes the blind server-side request forgery vulnerability in OIDC Dynamic Client Registration via jwks_uri.
securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion
Applicability is not stated in the release notes.
Keycloak 26.5.6 fixes the IDOR vulnerability in realm client creation and deletion.
securitymediumCVE-2026-3121, privilege escalation via manage-clients permission
Applies if you configure manage-clients permission.
Keycloak 26.5.6 fixes privilege escalation through the manage-clients permission.
+ 5 more on the release page

Source ↗

Keycloak26.5.5SecurityMar 5, 2026

CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
Keycloak 26.5.5 fixes an authentication bypass in the SAML broker caused by a disabled SAML client completing an IdP-initiated login.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
Keycloak 26.5.5 fixes improper enforcement of a disabled identity provider in IdentityBrokerService.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
Keycloak 26.5.5 fixes an issue where a disabled SAML identity provider could still allow IdP-initiated broker login.
+ 1 more on the release page

Source ↗

Keycloak26.5.4SecurityFeb 20, 2026

ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
This release fixes excessive SAMLRequest decompression that can cause denial of service.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
This release fixes the unchecked NotOnOrAfter handling in SubjectConfirmationData that can delay SAML brokering responses.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
This release adds the missing check for disabled clients in the Docker Registry Protocol.
+ 1 more on the release page

Source ↗

Keycloak26.5.1SecurityJan 14, 2026

CHECK 1OTHER 13View full analysis

Keycloak 26.5.1 is a maintenance release with a security fix in the Organization feature. It also contains correctness fixes, a performance improvement, and changes to HTTP responses and realm administration.

Check if affected (1)

securityThe Organization feature account-name exposure fix
Applies if you use the Organization feature.
The Organization feature no longer exposes and automatically fills the account name in the user/password form. The fix ships in Keycloak 26.5.1.

Source ↗

Keycloak26.5.0SecurityJan 6, 2026

CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

securityBrute force detection settings vulnerability, corrected
Applies if you configure brute force detection settings.
A vulnerability in brute force detection settings is corrected in Keycloak 26.5.0.
breakingPostgreSQL 13.x support removal
Applies if you depend on PostgreSQL 13.x.
Support for PostgreSQL 13.x is removed in Keycloak 26.5.0.

Plan ahead (1)

deprecatedFine-Grained Admin Permissions v1, deprecated
Applies if you enable admin/fine-grained-permissions.
Fine-Grained Admin Permissions v1 is deprecated in Keycloak 26.5.0 under admin/fine-grained-permissions.

Source ↗

Browse by month