Releases — RATATOSK

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
CVE-2026-7500 is addressed in the account API, correcting improper access control on the Keycloak server.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
CVE-2026-8922 is addressed in OIDC token introspection, which now accounts for the realm-level notBefore value.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
CVE-2026-8830 is addressed by adding the missing server-side WebAuthn validations.
+ 12 more on the release page

Source ↗