Keycloak 26.7.1 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: keycloak · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

⚡ Executive Summary (TL;DR)

Keycloak 26.7.1. Source highlight: Before upgrading refer to

Visit Keycloak Official Site ↗ Official Release Source ↗ All Keycloak Releases 📡 Keycloak RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

📄 View Raw Release Notes (Original Developer Log)

<div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/#migration-changes">the migration guide</a> for a complete list of changes.</p> <h2>All resolved issues</h2> <h3>Security fixes</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/49429">#49429</a> [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50445">#50445</a> [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50569">#50569</a> [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50615">#50615</a> [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50617">#50617</a> [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51467">#51467</a> CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher </li> <li><a href="https://github.com/keycloak/keycloak/issues/51468">#51468</a> CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation </li> <li><a href="https://github.com/keycloak/keycloak/issues/51469">#51469</a> CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text </li> <li><a href="https://github.com/keycloak/keycloak/issues/51470">#51470</a> CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction </li> <li><a href="https://github.com/keycloak/keycloak/issues/51471">#51471</a> CVE-2026-16443 SAML broker metadata import disables response signature validation </li> <li><a href="https://github.com/keycloak/keycloak/issues/51472">#51472</a> CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary </li> <li><a href="https://github.com/keycloak/keycloak/issues/51473">#51473</a> CVE-2026-16102 Default DCR policy allows role forgery via user property mappers </li> </ul> <h3>Bugs</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/50719">#50719</a> WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50750">#50750</a> Clustering test broken in 26.7 release branch <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50836">#50836</a> Kustomize cluster-wide faulty Role&RoleBinding <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50850">#50850</a> New Password is commited when multiple Password Reset is detected <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50882">#50882</a> 500 when client requests `organization` scope with it already set to `Default` <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50928">#50928</a> IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion <code>core</code></li> </ul> </div>

← Older Version Keycloak 26.7.0 Newer Version → Keycloak 26.7.2