Keycloak security fixes 26.7.4 to 26.8.0: the catch-up
Our last issue covered the one advisory Keycloak published on GitHub on 2026-09-16. Keycloak shipped more than that. The release notes for 26.7.4, 26.7.5 and 26.8.0 name 19 Keycloak CVEs and 7 dependency CVEs that never got a GitHub advisory. We were only watching the advisory feed. We read the release notes too now. This issue is late, and it is the full list.
Keycloak CVEs
| CVE | Severity | Summary | Fixed in | Issue |
|---|---|---|---|---|
CVE-2026-79651 |
High | Unauthenticated Denial of Service via Unbounded Locale Caching | 26.8.0, 26.7.4, 26.6.7, 26.4.16 | #52835 |
CVE-2026-74909 |
High | Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher | 26.8.0, 26.7.4, 26.6.7, 26.4.16 | #52836 |
CVE-2026-19607 |
Medium | Username Takeover Leading to Account Lockout | 26.8.0, 26.7.4, 26.6.7, 26.4.16 | #52837 |
CVE-2026-17526 |
High | Privilege escalation: the "impersonation" role can impersonate a realm administrator | 26.8.0, 26.7.4, 26.6.7, 26.4.16 | #52838 |
CVE-2026-18212 |
Medium | SAML Redirect DEFLATE helpers leak native zlib state | 26.8.0, 26.7.4, 26.6.7, 26.4.16 | #52839 |
CVE-2026-12388 |
not set | IdP mapper admin role escalation | 26.8.0 | #50444 |
CVE-2026-14781 |
not set | OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified | 26.8.0 | #50618 |
CVE-2026-16103 |
not set | Incomplete fix for CVE-2026-9798, CIBA brute-force lockout bypass at token redemption |
26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #50996 |
CVE-2026-18206 |
not set | Client policy source-host wildcard domains match non-subdomain suffixes | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #51278 |
CVE-2026-18203 |
not set | Group policy child-extension matches sibling group path prefixes | 26.7.5 (26.6.8 labelled, not yet released) | #51280 |
CVE-2026-18207 |
not set | Source-group condition matches duplicate group names and can skip negative-logic enforcement | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #51281 |
CVE-2026-18208 |
not set | Inactive out-of-audience introspection responses can include a signed JWT claim | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #51284 |
CVE-2026-18211 |
not set | Secure-client-uris localhost exception accepts localhost-prefixed attacker domains | 26.8.0, 26.7.5 | #51285 |
CVE-2026-18217 |
not set | SAML Redirect Binding Parameter Pollution | 26.8.0, 26.7.5 (26.6.8, 26.4.17 labelled, not yet released) | #51781 |
CVE-2026-19608 |
not set | Name-only group claims let same-name groups satisfy path-specific group policies | 26.8.0 | #51865 |
CVE-2026-4633 |
not set | User enumeration via identity-first login when Organizations feature is enabled | 26.8.0 | #52676 |
CVE-2026-89298 |
not set | Confidential client secret disclosed to view-clients role via Client Registration GET | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #52692 |
CVE-2026-88770 |
not set | Device Authorization Grant issues tokens to brute-force-locked accounts, a sibling of CVE-2026-9798 |
26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #52783 |
CVE-2026-93999 |
not set | Token-exchange refresh continues issuing tokens for a disabled audience client | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #53074 |
Dependency CVEs
| CVE | Severity | Summary | Fixed in | Issue |
|---|---|---|---|---|
CVE-2026-54515 CVE-2026-59889 |
Medium | com.fasterxml.jackson.core:jackson-databind 2.22.0 | 26.8.0 | #52168 |
CVE-2026-59903 |
Medium | io.netty:netty-codec-http:4.1.136.Final | 26.8.0 (26.6.8, 26.4.17 labelled, not yet released) | #52169 |
CVE-2025-66021 |
High | com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer | 26.8.0, 26.7.5 (26.6.8, 26.4.17 labelled, not yet released) | #52531 |
CVE-2026-84939 |
not set | org.freemarker:freemarker | 26.8.0, 26.7.5 (26.6.8, 26.4.17 labelled, not yet released) | #52888 |
CVE-2026-8798 |
High | org.bouncycastle:bc-fips | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #52972 |
CVE-2026-13505 |
High | org.bouncycastle:bc-fips | 26.8.0, 26.7.5 (26.6.8 labelled, not yet released) | #52974 |
Severity is Keycloak's own label. "Not set" means the issue carries none, so read the issue to judge it.
What clears them
- On 26.7.x: 26.7.5 clears everything above except 6 fixes that shipped only in 26.8.0. Two of them are the IdP mapper admin role escalation (
CVE-2026-12388) and the OIDC broker marking unverified email addresses as verified (CVE-2026-14781). Those need 26.8.0. - On 26.6.x or 26.4.x: 26.6.7 and 26.4.16 carry the 26.7.4-era fixes their rows list. The 26.7.5-era fixes are labelled for 26.6.8 and 26.4.17, which have not shipped yet.
CVE-2026-18203is labelled for 26.7.5 and 26.6.8 but not 26.8.0, and 26.8.0's notes do not list it. Check issue 51280 before treating 26.8.0 as covering it.
What breaks on the way there
We have not rehearsed 26.7.4, 26.7.5 or 26.8.0 in the lab yet. Those runs are queued, and the next issue will carry their records.
The last in-band hop we measured was 26.7.1 to 26.7.3, three times. It had no Liquibase changesets, took 24 seconds from stop to ready, and kept the realm config intact at 1,000 users (2026-08-31-26.7.1-to-26.7.3-1). 26.7.2 to 26.7.3 still dropped four API signatures that a custom provider could name (api-removals-by-hop, finding 1). Patch hops are not free, so read the release's migration notes before you take one.
Written by Ben Hart at MLabs. We rehearse Keycloak upgrades against seeded datasets in a lab and publish the records. We also run these upgrades, and the certificate lifecycle around them, for teams who would rather not. Talk to us about your project.