Keycloak 26.6.2 released
May 19 2026
To download the release go to Keycloak downloads.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
- #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
- #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services
- #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations
- #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core
- #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn
- #48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core
- #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint
- #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak
- #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data
- #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover
- #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account
- #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens
- #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission
- #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)
- #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration
Enhancements
- #47728 Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide
- #47734 Add dedicated "Monitoring Standbys" section to the general installation documentation
- #48329 JDBC_PING in 26.6 should not fail with 26.7 schema changes
- #48348 Escape expressions in JS blocks in FTL pages
- #48687 Upgrade to Quarkus 3.33.1.1
Bugs
- #38526 Duplicate user attribute values cannot be removed core
- #40602 Account UI reports "Something went wrong" when opening an unknown path account/ui
- #47882 Broken link in deploy-cnpg docs
- #47901 Realm import with --import-realm fails with ModelValidationException when Admin Permissions is enabled admin/fine-grained-permissions
- #47915 FreeMarker templates allow instantiation of new objects and even running OS commands login/ui
- #47987 FGAP v2 Specific Group permission has no scopes found in resource admin/fine-grained-permissions
- #48030 Update to operator version 26.6.0 needs deletion of all objects operator
- #48040 User session limit generates fatal error authentication
- #48094 Wrong referenced resource type in Workflow handling for clients core
- #48123 Clarify canonicalization in X.509 authentication authentication
- #48143 Ordering of permission and policy calls leads to exposure of a client ID admin/api
- #48185 Deleted workflow still attempting to run workflows
- #48241 JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title authentication
- #48259 Kubernetes identity providers docs still mention it to be a preview feature docs
- #48313 No escape approach for JS code inside the front channel logout FTL login/ui
- #48536 Review migration guide for rolling updates changes workflows
- #48629 WindowsServiceDistTest.testServiceLifecycle fails on slower runners due to insufficient startup timeout ci