Keycloak security fixes in 26.8.1
Keycloak 26.8.1 shipped on 2026-10-13. Its release notes and the issues they link name 18 Keycloak CVEs and 9 dependency CVEs, and none of them is on Keycloak's GitHub advisory feed. No 26.7.x release carries these fixes, so on 26.7 clearing them means the minor upgrade to 26.8.1.
Keycloak CVEs
| CVE | Severity | Summary | Issue |
|---|---|---|---|
CVE-2026-15943 |
Medium | OIDC identity provider update reuses the masked client secret after the token URL changes | #50945 |
CVE-2026-18569 |
Medium | OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled | #51381 |
CVE-2026-82968 |
Medium | Persistent wrong-account linking through null / GitHub identity provider | #52321 |
CVE-2026-94001 |
Medium | Admin credential DELETE bypasses a denied reset-password permission | #53057 |
CVE-2026-94000 |
not set | A delegated admin with only manage-users can become realm-admin by joining, or being created into, a group that maps an admin role |
#53060 |
CVE-2026-94218 |
Low | 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart |
#53070 |
CVE-2026-94215 |
Medium | Cross-realm realm resource read/write via the per-request session-level cache in RealmCacheSession |
#53071 |
CVE-2026-94213 |
Medium | Missing user view authorization in the Authorization Services policy evaluation endpoint, possibly an incomplete fix of CVE-2026-37978 |
#53072 |
CVE-2026-94217 |
Low | UMA scope merge across resource owners via a name collision in resolveResourcePermission |
#53073 |
CVE-2026-96446 |
Medium | PAR single-use bypass via prompt=none |
#53111 |
CVE-2026-96445 |
Medium | Conditional OTP trusts skip headers on untrusted proxy paths | #53112 |
CVE-2026-97177 |
Medium | Generic user update bypasses a denied reset-password permission | #53158 |
CVE-2026-95503 |
Medium | Potential KDC spoofing when Kerberos password authentication is enabled | #53159 |
CVE-2026-97311 |
Medium | Admin REST API roles/{role-name}/groups discloses groups the caller cannot view, an incomplete fix of the 26.7.2 hardening |
#53160 |
CVE-2026-97846 |
Medium | Standard Token Exchange skips required mTLS certificate binding and issues an active bearer token when no client certificate is supplied | #53187 |
CVE-2026-101333 |
Low | Unbounded metric series creation via the idp tag on the broker login endpoint |
#53338 |
CVE-2026-103884 |
Medium | Path traversal via an X.509 CRL Distribution Point, where a client-supplied CRL path escapes $KC_HOME/conf |
#53419 |
CVE-2026-107121 |
Medium | SMTP starttls=true permits a plaintext downgrade of credentials and messages |
#53674 |
Dependency CVEs
| CVE | Severity | Summary | Issue |
|---|---|---|---|
CVE-2026-91777 |
High | com.fasterxml.jackson.core:jackson-databind (2.x) | #53388 |
CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 CVE-2026-91776 CVE-2026-68497 |
not set | tools.jackson.core:jackson-databind 3.1.5, fixed in 3.1.7 | #53393 |
CVE-2026-102826 CVE-2026-102827 CVE-2026-102828 CVE-2026-102829 |
not set | simple-git and @simple-git/argv-parser. The only dependency path the issue shows is the create-keycloak-theme scaffolding tool |
#53582 |
Severity is Keycloak's own label. "Not set" means the issue carries none, so read the issue to judge it. Keycloak rates 14 of its 18 CVEs medium and 3 low. The one it leaves unrated is the delegated admin who can become realm-admin (CVE-2026-94000).
The notes also list 15 fixes under Weaknesses with no CVE id. One of them, #53354, is a SAML broker that verified a query-string signature over a different SAMLResponse than the one it processed. The issue titles it "unauthenticated login as an arbitrary user". If you broker SAML logins, read it before you schedule the upgrade.
What clears them
- On 26.8.0: 26.8.1 clears everything above.
- On 26.7.x: none of these fixes is labelled for 26.7.x, and there is no 26.7.6. Clearing them means the minor upgrade to 26.8.1, so read the migration guide first.
- On 26.6.x: every row above except the jackson-databind 3.x one is labelled for 26.6.8, which has not shipped. 26.6.7 is the newest 26.6 release.
- On 26.4.x: none of these fixes is labelled for 26.4.x.
What breaks on the way there
Our last issue said this one would carry lab records for 26.7.4, 26.7.5 and 26.8.0. It doesn't. Those runs haven't happened yet.
The closest hop we have measured is a minor jump inside 26. 26.0.0 went straight to 26.7.3 and reached ready in 20 seconds, with the index audit at 119 of 119 and all 1,000 users intact (2026-08-31-26.0.0-to-26.7.3-1). 26.7 to 26.8 is the same shape of hop, and we have not run it.
Minor hops are where the Java API moves. Every minor hop we measured removed between 17 and 137 signatures that a custom provider could name (api-removals-by-hop, finding 1). If you run custom providers, build them against 26.8.1 before the version moves.
Written by Ben Hart at MLabs. We rehearse Keycloak upgrades against seeded datasets in a lab and publish the records. We also run these upgrades, and the certificate lifecycle around them, for teams who would rather not. Talk to us about your project.