live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releaseIDENTITY

Keycloak 26.7.2 closes account-takeover paths and admin authorization gaps

The upstream identity release addresses eight CVEs, a cleartext vault-password exposure and a set of authentication and clustering regressions.

By The News Desk· Aug 19, 2026

The Keycloak project has released version 26.7.2 with fixes for eight CVEs, including two account-takeover paths, an administrative permissions bypass and disclosure of rotated client secrets. The release also removes a configuration weakness that could print a vault keystore password in clear text. Keycloak published the full resolved-issue list on August 19.

What changed

Two fixes address account recovery and linking flows. CVE-2026-15571 covers a predictable account-linking hash that could enable account takeover through a malicious OpenID Connect client. CVE-2026-18963 addresses an unauthenticated account takeover through a bypass in the reset-credentials flow.

The administrative surface receives several separate corrections. CVE-2026-14613 covers a Fine-Grained Admin Permissions bypass through the role-groups endpoint. CVE-2026-15945 fixes group-hierarchy search behavior that could disclose hidden parent groups under the second version of Fine-Grained Admin Permissions. CVE-2026-17048 addresses an Admin REST API path that exposed vault-resolved rotated client secrets.

Keycloak 26.7.2 also upgrades Jackson Databind to 2.21.5 for CVE-2026-59888 and CVE-2026-59889, and updates the OpenTelemetry Java SDK dependencies for CVE-2026-45292, an unbounded-memory-allocation issue in W3C baggage propagation.

Outside the CVE list, the project fixed show-config output that printed a vault keystore password in clear text. The release moves to Quarkus 3.33.3.1 as well.

Who should pay attention

Teams running the upstream 26.7 line should treat this as a security update rather than a routine point release. The takeover, authorization and secret-disclosure fixes affect core identity-management boundaries: who can recover an account, link an external identity, inspect group structure and retrieve client credentials.

The remaining bug fixes are operationally relevant too. They cover rotated client secrets remaining valid after the feature is disabled, user-property exposure without a permission check, email verification failures after a restart, HTTP/2 requests returning an unexplained 500, and upgrade failures when preview features interact with the stateless cluster provider.

What to do

Keycloak directs administrators to consult its migration guide before upgrading and provides 26.7.2 through the project’s normal download channel. Operators should prioritize the update, then verify the flows most closely tied to their deployment: password reset, account linking, delegated administration, group visibility and client-secret rotation.

Because several fixes sit at authorization boundaries, post-upgrade checks should use accounts with deliberately different administrative scopes. That is the quickest way to confirm that role-group access, hidden group ancestry and target-user attributes remain constrained as intended.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk