RATATOSKRATATOSK
ログイン

Keycloak

26.5.0Security
2026年1月6日

CHECK 2PLAN 1OTHER 247

Keycloak 26.5.0 は、機能追加と保守対応を含むリリースです。既存環境では、利用中の機能やデータベース構成、設定に影響する変更があります。

影響確認 (2)

  • securityブルートフォース検知設定の脆弱性修正

    ブルートフォース検知設定を使用している場合に適用されます。

    ブルートフォース検知設定に関する脆弱性が修正されました。

  • breakingPostgreSQL 13.x のサポート削除

    Keycloak のデプロイメントで PostgreSQL 13.x を使用している場合に適用されます。

    PostgreSQL 13.x のサポートが削除されました。

事前準備 (1)

  • deprecatedFine-Grained Admin Permissions v1 の非推奨

    Fine-Grained Admin Permissions v1 を使用している場合に適用されます。

    Fine-Grained Admin Permissions v1 の admin/fine-grained-permissions が非推奨になりました。

その他の記録済み変更 247 件すべてfixes 151 · additions 49 · value changes 24 · constraints 20 · defaults 2 · renames 1

fixes (151)

  • Ensure authorization_details from PAR requests are properly returned in token responses for conformace tests <code>oid4vc</code>
  • Fix inconsistencies in workflow condition evaluation
  • [OID4VCI] Handling KeyAttestationRequired properly
  • Fix OID4VCI Wallet Interoperability Issues (Draft 15 Compatibility & Metadata Compliance)
  • Kcadm.sh: (Better) Error messages on 302 redirect responses
  • Avoid 'duplicated mappers' Quarkus message for kc.dir
  • [FGAP] Make additional rest endpoints respect permissions
  • Authorization -> Evaluate: always returns "No search results"
  • Group permission denies to view user
  • Fallback to English translations for unknown locale despite German being the realm default
  • Cannot save new attribute group
  • Changing user profile attribute results in an error everytime
  • openid-connect flow is missing response type on language change
  • Incorrect logic of getArray() in ComponentModelScope
  • Slow initial GET /admin/realms/{realm}/users with cache enabled and large max parameter
  • UserStorageProviderModel parameter in ImportSynchronization.sync() method contains stale configuration data
  • Searching by non-searchable attributes returns all clients
  • Standard Token Exchange: chain of exchanges eventually fails
  • Key Type is not EC: ECDSA
  • Security Defenses realm settings lost when switching between Headers and Brute Force Detection tabs (v25+)
  • Group description missing on partial import
  • Race condition in authorization service leads to NullPointerException when evaluating permissions during concurrent resource deletion
  • KC_VERBOSE is not honored for a fast start
  • create clients without required value
  • Incorrect Basic Auth encoding for OIDC IDentity Provider when Client ID contains colon
  • Saving Client “Advanced” sets Request Object signature/encryption attributes to “any” even when not changed
  • Avoid NPE in FederatedJWTClientAuthenticator when checking for supported assertion types
  • Option description stuck with link
  • Update email page with pending verification email messages prefilled with old email
  • "Service accounts roles" should be "Service account roles"
  • Duplicate Email Fields on Temporarily Locked Out Sign In With Organization Identity-First Login
  • keycloak-operator 26.4.0 missing clusterrole permissions
  • Regression in DEBUG_PORT handling since 26.4.0 – host binding (*:port / 0.0.0.0:port) no longer works
  • Restarting an user session broken for persistent sessions
  • Backend url misses the path with reverse proxy
  • Field "Created at" shows "Invalid Date" when created through KeycloakRealmImport
  • IntComponent doesn't show if a field is required
  • Cannot revoke access token generated by Standard Token Exchange
  • UI crash on admin /users/add-user since 26.4.0
  • Make sure username and email attributes are lower cased when fetching their values from LDAP object
  • XPathAttributeMapperTest fails on Ubuntu with OpenJDK 17
  • FIPS1402JWKTest and FIPS1402SecureRandomTest fails on Ubuntu with OpenJDK 25
  • SdJwtTest and UndisclosedClaimTest fails on Windows with OpenJDK 17
  • Keycloak 26.4 returns a different error response on a token request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does
  • Keycloak 26.4 returns a different error response on a CIBA backchannel authentication request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does
  • SAML Client - Encrypt assertions toggle shows wrong dialog text (Client signature required)
  • Sessions not removed when user is deleted
  • "Remember me" user sessions remain valid after "remember me" realm setting is disabled
  • NullPointerException when disabling Admin Permissions (FGAP) in Realm - GET /users returns 500
  • First JDBC_PING initialization happens in the JTA transaction context
  • Client session may be lost during session restart
  • SPIFFE client authentication does not work when JWT SVID includes iss claim
  • FGAP/UI: reset-password succeeds but UI shows 403 without Users:manage
  • DPoP proof replay check doesn't consider clock skew
  • Social provider icons not displayed when alias differs from provider type
  • Deleting Client is slow and fails when a lot of client sessions exist
  • kcadm.ssh config credentials fails when there is a % in the client secret
  • Unrecognized field "kty" (class org.keycloak.jose.jwk.JSONWebKeySet), not marked as ignorable (one known property: "keys"])
  • Server does not shutdown gracefully when started with --optimized
  • Invalid liquibase check sum for jpa-changelog-2.5.0.xml
  • "admin" client role now requires server admin user
  • 403 Forbidden when assigning realm-management client roles with realm-admin despite FGAP disabled (regression in 26.4.0+)
  • FGAP: user can no longer open account management page, broken by reset-password
  • Version 26.4.1 breaks existing ldap users with capital letters in username
  • Local user can't login when ldap error
  • Setting "Backchannel logout session required" displayed incorrectly
  • When syncing roles, the database layer can see deadlocks
  • H2 database URL augmentation does not consider db-url-properties
  • Role Mapper is updating the user every time on login
  • Unused message properties for the LDAP mappers
  • Email Not Persisted During Registration When "Email as Username" is Enabled and User Edit Permission is Disabled
  • Only add the none verifier when attestation conveyance preference is none (or default)
  • Refresh token allowed for offline session even the related scope is removed
  • FGAP V2: reset-password scope error when viewing users with Group permissions only
  • UPDATE_EMAIL action invalidates old email
  • Increased memory usage due to leaking KeycloakSession instances
  • LDAP synchronization happens too often in a cluster and always clears the cache
  • QuarkusKeycloakSession not garbage collected when running Liquibase
  • QuarkusKeycloakSession kept in memory for each timer
  • Under OLMv1 service monitor check uses wrong namespace
  • QuarkusKeycloakSession leak in DeclarativeUserProfileProvider
  • import does not seem to run db migration
  • Admin console sends non-JSON payload with content-type: application/json
  • partial import fails to overwrite existing groups
  • Cannot issue vc of type oid4vc_natural_person
  • useHash hook does not correctly extract hash from pushState URL
  • [quarkus-next] Removed exception escaped OTel attribute
  • Ensure the logout endpoint removes the authentication session
  • JS Policy is used in the "Default Policy" for Authorization
  • Creating group policy on a client uses "manage-clients" role if FGAP V1 is disabled
  • AUTH_SESSION_ID cookie has the incorrect route
  • Adding a client mapper stays on creation screen, with error on second save
  • MessageFormatterMethod does not detect/map SimpleNumber causing IllegalArgumentException
  • Ordering attributes will unset the unmanaged attribute policy
  • Can't build keycloak 26.4.4 with quarkus.launch.rebuild=true
  • Allow only normalized URLs in requests caused a regression in view authz permission details in Admin Consol
  • Retrieving row count to evaluate index creation takes a long time on PostgreSQL and big tables
  • Missing message properties when redenring pages for organization invites
  • [OID4VCI] Credential Offer must be created by Issuer not Holder
  • Double-encoding of query parameter values (e.g. acr_values) for version 26.4
  • [BUG] 'master' realm lockout due to NullPointerException when "Conditional 2FA" is moved before "Username Password Form"
  • Disabling/enabling workflows result in validation errors and the name is missing from representation
  • [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry
  • OIDC identity provider should allow to setup JWKS URL (or hardcoded keys) when JWT authorization grant enabled
  • Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions
  • [OID4VCI] JWT VC Issuer Metadata well-known endpoint should be available at /.well-known/jwt-vc-issuer/realms/{realm}
  • OIDC Dynamic Client Registration update problem when Service Account was enabled/ disabled
  • Admin Client creates malformed paths for requests
  • Stack trace in browser console when updating password
  • Unsupported Pod template can cause AUTO logic to keep StatefulSet at 0 replicas
  • Caching of static theme resources in dev mode is disabled
  • Failure when decrypting SAML Assertions with HSM provided key
  • View-Group Permission shows Users in User-List
  • Grammar error in LDAP federation group mapper
  • Logical error in Danish email verification message - tells users to ignore if they DID create account
  • Upgrade with Mysql and migration-strategy=manual when db user has non alter table permissions
  • Unlocalized date format in (email messages)
  • Description of Passkey is not escaped on the login screen
  • Delete user step in workflows is not removing other scheduled steps the user might have
  • Workflows are restarting on any event instead of the one that activates it
  • Removing a user's group is not activating workflows that use the user-group-membership-removed event
  • NPE when importing SAML EntityDescriptor without SPSSODescriptor
  • Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients
  • ClassCastException on mixing AddressMapper with ClaimMapper
  • Wrong persistent group permissions when multiple group membership changes happen in the same request
  • The existence of an organization attribute called “id” is not validated
  • [admin-api-v2] Create client does not return 201 status code
  • Missing Romanian locale from Supported locales
  • Manual sync not executed because of the last sync time
  • LDAP group mapper executed multiple times in the same request
  • Remote Infinispan should return count per client only for the current realm
  • [admin-api-v2] Incorrect DTO/DAO mapping
  • Unhandled error caused by unknown SAML tag during XML parsing
  • Compilation failure in JWTAuthorizationGrantJWTClaimsClientPoliciesTest
  • Credential offer endpoint has parameter user_id, but expects username
  • Alias in JWT Authorization Grant idp should not be editable
  • Keycloak throws a 500 when invalid Accept header
  • Typo: missing '>' on closing </form> in keycloak.v2 link-idp-action.ftl
  • No "Sign in with Passkey" on first step with organization:<alias> scope
  • OID4VCIssuerEndpoint.getCredentialOfferPreflight uses incorrect name of the parameter
  • OID4VC metadata endpoint returns deferred_credential_endpoint even if not supported
  • Workflows look up entries from the database on each event
  • CredentialRequest with credentialIdentifier does not work when credential-offer was created by OAuth2 authorization_code grant
  • Claims configued by OID4VCI protocol mappers as mandatory are not enforced to be mandatory
  • Notification_id returned from the credential response
  • JWTClientSecretAuthenticator throws NPE if client assertion is not set
  • Missing message keys for USER_SESSION_DELETED
  • ${kc.org} Organisation Confirm Membership Title in messages_de.properties should be ${kc.org.name}
  • Default redirect URI for an organization should be the Home URL of the account client
  • Missing repeatHelp translation key in Time policy
  • Admin UI: User attribute filter reset does not refresh user list

additions (49)

  • Keycloak 26.5 introduces a new feature called JWT Authorization Grant, which adds support for <a href="https://datatracker.ietf.org/doc/html/rfc7523">RFC 7523</a> to use external signed JWT assertions to request OAuth 2.0 access tokens.
  • For the OpenID Connect Dynamic Client Registration, you can now specify which CORS headers are allowed via the client registration access policies.
  • you can now allow environment specific headers to be allowed using the SPI option <code>spi-cors--default--allowed-headers</code>.
  • The client logout configuration now includes an option to show a logout confirmation page.
  • You can now prevent this by disabling <strong>Include in OpenID Provider Metadata</strong>.
  • Keycloak introduces a new preview feature called Workflows, which allows administrators to automate administrative tasks and process within a realm
  • Organization administrators can now manage organization invitations through both the Admin Console and REST API:
  • For each expired user session there is a new user event <code>USER_SESSION_DELETED</code> fired.
  • In order to apply it, you need to explicitly enable the feature <code>http-optimized-serializers</code>.
  • Keycloak has now more flexibility how to configure retrying of outgoing HTTP requests.
  • You can now enable or disable individual features using the <code>feature-&lt;name&gt;</code> option
  • You can now use a new client certificate lookup provider that is compliant with <a href="https://datatracker.ietf.org/doc/html/rfc9440">RFC 9440</a>.
  • The new <code>tools windows-service</code> CLI subcommand simplifies service installation and uninstallation.
  • Keycloak now supports exporting logs to OpenTelemetry collectors
  • Keycloak now provides the experimental support for exporting metrics to OpenTelemetry collectors
  • You can specify these headers via the <code>tracing-header-&lt;header&gt;</code> wildcard option, accepting any custom header name.
  • Support Caddy as a Reverse Proxy Provider for Client Certificate Authentication
  • Admin API v2: Blueprint
  • Possibility to backchannel logout the clients belonging to a specific user session
  • Expose scheduled tasks and start time
  • Allow configuration for SMTP timeouts via configuration
  • Provide a way to add custom labels to Realm Import job of Keycloak operator
  • [OTel] Provide general options for telemetry settings <code>observability</code>
  • Add more fields to the Welcome Page
  • Add operation to cancel a workflow execution for a resource
  • Create a LocalCacheProvider SPI
  • Add configurable retry logic for OCSP certificate validation checks <code>core</code>
  • [RLM] - Allow updating workflow conditions
  • [RLM] - Ability to define workflows with YAML
  • [RLM] - Restarting a workflow for a resource based on the step chain <code>workflows</code>
  • [RLM] - Canceling workflows for a given resources when a new event is triggered
  • [RLM] - Allow using time-based tokens when setting fields that expect a period or time
  • Add rate limiter for sending verification emails in context of update email
  • Make pending email verification attribute removable by admin <code>user-profile</code>
  • Workflows UI needs to implement authorization <code>admin/ui</code>
  • Role authorization for workflows.
  • Export default routes from npm UI packages
  • Ability to enable/disable feature via single property
  • Add operation to retrieve the workflows that are currently active for a resource
  • Provide a way to evaluate event properties when matching events to workflows
  • Add autofocus property to "Sign in with passkey" button in keycloak.v2 login theme.
  • [Login UI v2] Configurable Password Visibility-Toggle Icons
  • Downscoping for standard token exchange
  • Allow restarting the step chain at a specific position
  • Publish an event for logging out a single session or all sessions or all sessions via the Account Console
  • Publish an event when the UserSessionLImitsAuthenticator terminates an older session
  • Allow running scheduled workflows
  • Add Basque (eu) translation support for Keycloak UI
  • ServiceMonitor is not created by keycloak operator

value changes (24)

  • you should see reduced response times when authenticating users.
  • Expired user sessions are now deleted from the database in small batches
  • The <code>log-mdc:v1</code> feature has been promoted from a preview feature to a supported feature.
  • Delete Client and role's admin event doesn't have representation while other delete entities have the representation
  • Make picocli auto color match the quarkus logic
  • SELECT COUNT(*) FROM called multiple times for an index creation <code>core</code>
  • incorrect flow with login_hint specified for user in org email domain <code>organizations</code>
  • Hide read-only email attribute in update profile context with update email enabled <code>user-profile</code>
  • Log FIPS provider using info debug level
  • JDBC_PING should publish its physical address on startup
  • All config formatting for list options could be improved
  • Run time comparisons in SD-JWT and SD-JWT VP verification with account of possible clock skew
  • Ensure delete-user step doesn't trigger removal of federated user from federation provider
  • Upgrade to Quarkus 3.27.1
  • Add missing secret warning status
  • Store workflows YAML definition as a blob
  • Improve error message for the HTTPS material loading
  • Avoid un-escaped strings in the login templates for HTML entities
  • Ignore null values when serializing workflows using YAML
  • Disable state transfer for session caches when persistent sessions are enabled
  • Improvements to the notify step
  • Avoid using HTML in backend messages in the login theme
  • Avoid flushing user information in batch mode
  • Infinispan: LoginFailures entries should expire

constraints (20)

  • There is now preview support to use Kubernetes service accounts tokens as credentials for clients, which avoids static secrets for OpenID Connect clients.
  • The containers for both the Keycloak and its operator are not available as well for the PowerPC 64-bit Little Endian (ppc64le) architecture.
  • Prevent users configuring max-count=-1 for caches with a default upper-bound
  • Validate client session session timeout and lifetime settings on edit
  • Relax CORS policy on credential offer endpoint
  • Remove need to specify workflow condition parameter in double quotes
  • Add validation for Workflwow, Condition and Steps fields
  • Warn or error on duplicate options
  • Allow non-optimized start to run without a separate vm launch
  • SPIFFE should support OIDC JWK endpoint
  • Allow groups to be referenced by path in workflow conditions
  • Workflows UI must allow for definition of workflows using YAML
  • Admin client should be able to handle YAML payloads for workflows
  • Add pagination and search by name capabilities to the workflows endpoint
  • Allow UI to retrieve Workflow definitions without their ids
  • Keycloak compatibility with PostgreSQL 18
  • Support EDB 18
  • HttpClient provider should allow connectionRequestTimeout to be settable
  • Improve workflow concurrency settings to allow cancelling a workflow based on an event
  • Validate client session timeout and lifetime settings on realm settings edit

defaults (2)

  • Set automountServiceAccountToken: false on Keycloak pods
  • Default to log color enabled

renames (1)

  • [OID4VCI] Realign naming of attribute configuring algorithms for credential signing
Keycloakをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Keycloakのリリース一覧 →