Releases

Action needed (8)

• securityhighCVE-2026-9099, group-admin escalation to realm-admin

  Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.

• securityhighCVE-2026-9086, cross-site scripting via URI validation bypass

  Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.

• securityhighCVE-2026-9795, improper scope mapping enforcement

  Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.

• securityhighCVE-2026-9800, policy enforcer URI comparison

  Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.

• securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass

  Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.

• securitymediumCVE-2026-9083, arbitrary filesystem path probing

  Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.

• securitymediumCVE-2026-9705, disabled client takeover

  Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.

• securitymediumCVE-2026-9799, UMA permission ticket bypass

  Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.

Action needed (2)

• securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507

  Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

• securityGo 1.25.10 dependency upgrade

  Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Action needed (1)

• securityhighGo updated to v1.26.4

  Go is updated to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (3)

• securitymediumMySQL schema migrations 008

  Applies if you use the MySQL backend.

• securityConstant-time preshared key authentication

  Applies if you use preshared key authentication.

• securityRequired OIDC issuer and audience configuration

  Applies if authn.method is set to oidc.

Action needed (1)

• securitymediumThe Go 1.26.4 build toolchain update

  OPA is built with Go 1.26.4 in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as GO-2026-5037 and GO-2026-5039.

Action needed (2)

• securityThe Go toolchain, updated to 1.26.4

  OpenFGA v1.17.1 updates the Go toolchain version to 1.26.4 to address Go standard library vulnerabilities.

• securitygrpc-health-probe updated to v0.4.52

  Released images update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so they no longer ship the Go standard library vulnerabilities addressed by this update.

Action needed (2)

• securityhighCVE-2026-4800 lodash code injection

  CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.

• securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization

  CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Action needed (1)

• securityTLV-based cache key generation

  OpenFGA v1.17.0 redesigns cache key generation with TLV binary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.