26.7.2
📦 keycloakView on GitHub →
🐛 23 fixes🔧 15 symbols
Summary
This release addresses numerous security vulnerabilities, including issues related to memory allocation, permission bypass, and secret leakage. It also includes several bug fixes and dependency upgrades, such as to Quarkus 3.33.3.1 and jackson-databind 2.21.5.
Migration Steps
- Refer to the migration guide for a complete list of changes: https://www.keycloak.org/docs/latest/upgrading/#migration-changes
🐛 Bug Fixes
- Fixed CVE-2026-45292: OpenTelemetry Java SDK unbounded memory allocation in W3C Baggage Propagation.
- Fixed CVE-2026-14613: Fine-Grained Admin Permissions Bypass via Role Groups Endpoint.
- Fixed CVE-2026-59888 and CVE-2026-59889: Upgraded jackson-databind to 2.21.5.
- Fixed CVE-2026-15945: Group hierarchy search disclosed hidden parent groups under FGAP v2.
- Fixed CVE-2026-17048: Keycloak Admin REST API leaked vault-resolved rotated client secrets.
- Fixed CVE-2026-15571: Predictable account-linking hash enabling account takeover via malicious OIDC client.
- Fixed CVE-2026-18963: Unauthenticated account takeover via reset-credentials flow bypass.
- Fixed #50844: show-config no longer prints the vault keystore password in cleartext.
- Fixed #50751: Resolved fpp warning on startup with large pre-computed .bloom file for password denylist.
- Fixed #50849: Corrected SCIM name format.
- Fixed #50855: Rotated client secret no longer remains valid when the feature is disabled.
- Fixed #51054: Resolved invalid redirect URI on logout from pages with sub-tab hash fragments.
- Fixed #51061: Parameterized UserPropertyMapper no longer exposes target user attributes without permission check.
- Fixed #51087: Passkey icons now use the correct color variant when realm disables dark mode.
- Fixed #51088: Verify email is now working in incognito browser tabs after Keycloak restart.
- Fixed #51131: Resolved "Proactive closing of the session was missed" warning.
- Fixed #51154: Upgrade to 26.7.0 no longer fails with preview features due to stateless cluster provider capturing a null NodeInfo.
- Fixed #51164: WebAuthn tests are no longer skipped in Github workflows.
- Fixed #51182: Large HTTP/2 request headers are no longer rejected with a bare 500; requests now work over HTTP/1.1.
- Fixed #51323: Custom realm-level role named admin can now be updated in non-master realms after Keycloak 26.7.0.
- Fixed #51331: Adding org members no longer fails with 500 when stateless:v1 feature is enabled.
- Fixed #51407: Java API docs distribution is no longer empty.
- Fixed #51449: Corrected the query parameter name for "max".