Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #47485](https://github.com/href="https://github.com/keycloak/keycloak/issues/47485">/issues/47485) CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
- #47486](https://github.com/href="https://github.com/keycloak/keycloak/issues/47486">/issues/47486) CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
- #47932](https://github.com/href="https://github.com/keycloak/keycloak/issues/47932">/issues/47932) [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters
authorization-services - #48049](https://github.com/href="https://github.com/keycloak/keycloak/issues/48049">/issues/48049) [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler
organizations - #48275](https://github.com/href="https://github.com/keycloak/keycloak/issues/48275">/issues/48275) CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
core - #48388](https://github.com/href="https://github.com/keycloak/keycloak/issues/48388">/issues/48388) [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration
authentication/webauthn - #48570](https://github.com/href="https://github.com/keycloak/keycloak/issues/48570">/issues/48570) [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs
core - #49108](https://github.com/href="https://github.com/keycloak/keycloak/issues/49108">/issues/49108) [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint
- #49109](https://github.com/href="https://github.com/keycloak/keycloak/issues/49109">/issues/49109) [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak
- #49110](https://github.com/href="https://github.com/keycloak/keycloak/issues/49110">/issues/49110) [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data
- #49111](https://github.com/href="https://github.com/keycloak/keycloak/issues/49111">/issues/49111) [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover
- #49112](https://github.com/href="https://github.com/keycloak/keycloak/issues/49112">/issues/49112) [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account
- #49113](https://github.com/href="https://github.com/keycloak/keycloak/issues/49113">/issues/49113) [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens
- #49114](https://github.com/href="https://github.com/keycloak/keycloak/issues/49114">/issues/49114) [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission
- #49115](https://github.com/href="https://github.com/keycloak/keycloak/issues/49115">/issues/49115) [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)
- #49116](https://github.com/href="https://github.com/keycloak/keycloak/issues/49116">/issues/49116) [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration
Enhancements
- #47728](https://github.com/href="https://github.com/keycloak/keycloak/issues/47728">/issues/47728) Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide
- #47734](https://github.com/href="https://github.com/keycloak/keycloak/issues/47734">/issues/47734) Add dedicated "Monitoring Standbys" section to the general installation documentation
- #48329](https://github.com/href="https://github.com/keycloak/keycloak/issues/48329">/issues/48329) JDBC_PING in 26.6 should not fail with 26.7 schema changes
- #48348](https://github.com/href="https://github.com/keycloak/keycloak/issues/48348">/issues/48348) Escape expressions in JS blocks in FTL pages
- #48687](https://github.com/href="https://github.com/keycloak/keycloak/issues/48687">/issues/48687) Upgrade to Quarkus 3.33.1.1
Bugs
- #38526](https://github.com/href="https://github.com/keycloak/keycloak/issues/38526">/issues/38526) Duplicate user attribute values cannot be removed
core - #40602](https://github.com/href="https://github.com/keycloak/keycloak/issues/40602">/issues/40602) Account UI reports "Something went wrong" when opening an unknown path
account/ui - #47882](https://github.com/href="https://github.com/keycloak/keycloak/issues/47882">/issues/47882) Broken link in deploy-cnpg
docs - #47901](https://github.com/href="https://github.com/keycloak/keycloak/issues/47901">/issues/47901) Realm import with --import-realm fails with ModelValidationException when Admin Permissions is enabled
admin/fine-grained-permissions - #47915](https://github.com/href="https://github.com/keycloak/keycloak/issues/47915">/issues/47915) FreeMarker templates allow instantiation of new objects and even running OS commands
login/ui - #47987](https://github.com/href="https://github.com/keycloak/keycloak/issues/47987">/issues/47987) FGAP v2 Specific Group permission has no scopes found in resource
admin/fine-grained-permissions - #48030](https://github.com/href="https://github.com/keycloak/keycloak/issues/48030">/issues/48030) Update to operator version 26.6.0 needs deletion of all objects
operator - #48040](https://github.com/href="https://github.com/keycloak/keycloak/issues/48040">/issues/48040) User session limit generates fatal error
authentication - #48094](https://github.com/href="https://github.com/keycloak/keycloak/issues/48094">/issues/48094) Wrong referenced resource type in Workflow handling for clients
core - #48123](https://github.com/href="https://github.com/keycloak/keycloak/issues/48123">/issues/48123) Clarify canonicalization in X.509 authentication
authentication - #48143](https://github.com/href="https://github.com/keycloak/keycloak/issues/48143">/issues/48143) Ordering of permission and policy calls leads to exposure of a client ID
admin/api - #48185](https://github.com/href="https://github.com/keycloak/keycloak/issues/48185">/issues/48185) Deleted workflow still attempting to run
workflows - #48241](https://github.com/href="https://github.com/keycloak/keycloak/issues/48241">/issues/48241) JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title
authentication - #48259](https://github.com/href="https://github.com/keycloak/keycloak/issues/48259">/issues/48259) Kubernetes identity providers docs still mention it to be a preview feature
docs - #48313](https://github.com/href="https://github.com/keycloak/keycloak/issues/48313">/issues/48313) No escape approach for JS code inside the front channel logout FTL
login/ui - #48536](https://github.com/href="https://github.com/keycloak/keycloak/issues/48536">/issues/48536) Review migration guide for rolling updates changes
workflows - #48629](https://github.com/href="https://github.com/keycloak/keycloak/issues/48629">/issues/48629) WindowsServiceDistTest.testServiceLifecycle fails on slower runners due to insufficient startup timeout
ci