Keycloak 26.8.2: 33 CVEs and a Critical SAML Bypass
Bottom line: upgrade now if Keycloak terminates or brokers SAML; within the week otherwise. Keycloak 26.8.2 fixes 33 CVEs. The one that should move your schedule is critical and needs no credentials — a signature bypass in the SAML HTTP-Redirect binding that upstream describes as leading to full account takeover of federated users. The harder problem is that 26 of the 33 have no published advisory yet, so most of this release carries no severity you can plan against.
That 33 is upstream's Security fixes list counted entry by entry; 36 CVE ids appear in the notes, three cited only as earlier issues this release repairs.
Should you upgrade?
| If you… | When |
|---|---|
| Terminate or broker SAML over the HTTP-Redirect binding | Now. CVE-2026-117691, CVSS 9.1, no authentication needed |
| Run 26.8.0 or 26.8.1 with organizations enabled | Now. Account takeover through identity-first login, reproduced on 26.8.1 |
| Expose any realm endpoint to the internet | This week. Five denial-of-service fixes, four of them unauthenticated, one a single-request JVM kill |
| Allow Dynamic Client Registration | This week. Four fixes for protocol mappers that forge sub, aud, azp or role claims |
| Run 26.7, 26.6 or 26.4 | There is no patch on your branch. See below |
Budget time for it. 26.8.2 ships fourteen breaking changes — most of them the hardening behind these CVEs.
The fix that should move your schedule
CVE-2026-117691 / GHSA-c85j-3hq2-q6wj, critical, CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Keycloak processed percent-encoded query parameter names — %53AMLResponse — while signature verification matched only literal ones. An attacker supplies a crafted unsigned SAML message and the server acts on it instead of the signed one.
This is the second verification bypass in the same code path in two releases: 26.8.1 fixed the variant that abused ; as a parameter separator. If you deferred that upgrade you are carrying both. Any realm with a SAML identity provider or a SAML client on the redirect binding is exposed; OIDC-only realms are not.
The advisory went up the same day as the release and carries no affected-version data, so treat "every 26.8.x before 26.8.2" as the working assumption and read it directly.
The other critical is a library, not a Keycloak control
CVE-2026-111497 / GHSA-9v8h-qqgm-4m35 is the Brotli decoder out-of-bounds write ("Node2Shell"), rated critical 9.8 with an EPSS of 0.83. Both numbers describe Google Brotli 1.0.3 through 1.2.0, not Keycloak — the fixed versions in that advisory are 1.0.10, 1.1.1 and 1.2.1, which are Brotli releases, not Keycloak ones. Keycloak's own exposure is not separately rated.
Keycloak did not upgrade the library. It excluded brotli4j from the Quarkus HTTP paths (#54333), removing the decoder from the distribution. The published sources do not settle whether an unauthenticated request could reach it before — read the advisory.
Security fixes
Seven of the 33 have a published advisory:
| CVE / advisory | Severity | What it is |
|---|---|---|
| CVE-2026-117691 / GHSA-c85j-3hq2-q6wj | critical 9.1 | SAML redirect binding acts on an unsigned message |
| CVE-2026-111497 / GHSA-9v8h-qqgm-4m35 | critical 9.8 | Brotli decoder overflow — the library, not a Keycloak control |
| CVE-2026-96448 / GHSA-x6m6-7qg7-7r64 | medium 6.6 | FGAP v2 role check ignores composites, so a limited admin can assign realm-admin |
| CVE-2026-92358 / GHSA-prm3-wvj6-64vx | medium 6.4 | Account-link proof survives unlink; the external IdP can relink silently |
| CVE-2026-107889 / GHSA-gv8g-wx99-6r59 | medium 5.5 | Stored XSS on the login page via a kcSanitize bypass |
| CVE-2026-105305 / GHSA-ggxp-hq23-v84f | medium 5.4 | Device Authorization Grant ignores minimum.acr.value, bypassing MFA |
| CVE-2026-107623 / GHSA-qxj8-968q-qm7w | medium 4.3 | A DCR update silently disables offline token revocation on backchannel logout |
The other 26 have no advisory, so they carry no severity and we will not estimate one. Their titles are not reassuring — account takeover via an authentication race, a missing Admin API audience check, UMA cross-owner resource access — but a title is not a rating. Read the issues from the release notes and judge your own exposure. "Unrated" is a gap in the public record, not a verdict either way.
If you run 26.7, 26.6 or 26.4
Checked 5 November against upstream branches and tags, because the advisories carry no backport data.
| Branch | Newest release | Newest tag | These fixes | Image |
|---|---|---|---|---|
| 26.8 | 26.8.2 (5 Nov) | 26.8.2 | all 33 | 26.8.1 — 26.8.2 not built yet |
| 26.7 | 26.7.5 (30 Sep) | 26.7.5 | none | 26.7.5 |
| 26.6 | 26.6.4 (Jun) | 26.6.7 (7 Sep) | none | 26.6.7 |
| 26.4 | 26.4.7 (Dec 2025) | 26.4.16 (7 Sep) | none | 26.4.16 |
No backport exists. 26.8.2 is the only build carrying any of these fixes. release/26.7 has been archived — 26.7 is end of life and 26.7.5 was its last. release/26.6 and release/26.4 are still live but neither has taken a commit since mid-October or a tag since 7 September. On an older branch your only path today is 26.8 — a minor upgrade, on top of 26.8.0's and 26.8.1's own breaking changes.
Tags live on quay.io/phasetwo/keycloak, including the backports upstream tags but never announces. 26.8.2 was not built at the time of writing — check the list.
Breaking changes and migration
Fourteen, which is a lot for a patch. The ones most likely to break you:
- The Admin REST API enforces an audience check through a new
kc-admin-apiclient scope (CVE-2026-19688). Service accounts calling the Admin API need it. - Protocol mapper management via the Admin API is restricted to realm administrators, and client registration policies limit mapper types, default roles and full scope.
- SAML 1.1 request parsing is off by default; SOAP endpoints cap requests at 120,000 bytes.
- The SAML broker requires a valid bearer subject confirmation and rejects
ProxyRestrictionassertions, and the SAML adapter validates the IdP issuer. - Token exchange tokens can no longer outlive the subject token.
- IdP auto-linking requires a verified email (CVE-2026-97175), as does organization domain-based membership.
The official release notes still stop at 26.8.0; all fourteen are in the migration changes.
How to upgrade
Rehearse the Admin API scope and SAML broker changes on staging; both fail quietly. Our production checklist covers the exposure questions above, and self-service upgrades covers the mechanics.
Our managed Keycloak clusters are patched in our maintenance windows, under SOC 2 Type II and ISO 27001. Talk to us if you would rather not schedule this one yourself.