Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KeycloakClear ×

Keycloak26.7.0SecurityJul 9, 2026

ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
CVE-2026-9796 corrects a time-of-check to time-of-use bypass in admin role renaming that could enable realm-wide escalation from manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
CVE-2026-9689 corrects HTTP parameter pollution in the OIDC redirect URI, which allowed response parameter duplication.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
CVE-2026-9798 corrects a bypass of brute-force account lockout in the CIBA authentication flow.
+ 16 more on the release page

Plan ahead (4)

deprecatedThe V1 API, deprecated
Applies if you use V1.
V1 is deprecated in this release but remains enabled by default for backward compatibility.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
The Require Discoverable Credential option is deprecated in this release.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
The Twitter IDP implementation is deprecated because it uses the old twitter4j library.
+ 1 more on the release page

Source ↗

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
CVE-2026-7500 is addressed in the account API, correcting improper access control on the Keycloak server.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
CVE-2026-8922 is addressed in OIDC token introspection, which now accounts for the realm-level notBefore value.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
CVE-2026-8830 is addressed by adding the missing server-side WebAuthn validations.
+ 12 more on the release page

Source ↗

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
The release fixes the denial-of-service issue caused by a crafted request to the /saml endpoint, identified by CVE-2026-7307.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
The release fixes access token disclosure and implicit flow bypass through forged client data, identified by CVE-2026-7571.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
The release fixes session fixation in the OIDC login flow that could lead to account takeover, identified by CVE-2026-7507.
+ 9 more on the release page

Source ↗

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
Workflows execution no longer bypasses admin permission boundaries from manage-realm to realm-admin.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
Organizations login no longer leaks IdP aliases when no Organization is resolved, preventing IdP and tenant enumeration.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
The SCIM PUT endpoint no longer permits resource modification through a body ID override.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.
Token Exchange v1 is deprecated in this release.

Source ↗

Keycloak26.5.0SecurityJan 6, 2026

CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

securityBrute force detection settings vulnerability, corrected
Applies if you configure brute force detection settings.
A vulnerability in brute force detection settings is corrected in Keycloak 26.5.0.
breakingPostgreSQL 13.x support removal
Applies if you depend on PostgreSQL 13.x.
Support for PostgreSQL 13.x is removed in Keycloak 26.5.0.

Plan ahead (1)

deprecatedFine-Grained Admin Permissions v1, deprecated
Applies if you enable admin/fine-grained-permissions.
Fine-Grained Admin Permissions v1 is deprecated in Keycloak 26.5.0 under admin/fine-grained-permissions.

Source ↗

Browse by month