Keycloak 26.7.4 released

September 16 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

#52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
#52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
#52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
#52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
#52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
#52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state

#49635 Performance issue with 26.6.2 dist/quarkus
#51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci
#52015 New links errors for https://quarkus.io/guides docs
#52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan
#52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api
#52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus
#52241 Clicking on a sub group in the admin console throws an exception admin/ui
#52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite
#52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite