live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releaseIDENTITY

Keycloak 26.7.2 closes two account-takeover paths and five other security flaws

The upstream fix lands on the 26.7 line; operators on other streams should follow their distributor’s advisory rather than assume the same backport.

By The News Desk· Aug 20, 2026

Keycloak 26.7.2 is a security-heavy point release. Its upstream release page lists seven security-fix entries, including two account-takeover vulnerabilities, a fine-grained administration bypass, hidden-group disclosure and leakage of a rotated client secret after vault resolution.

Who is exposed to what

CVE-2026-15571 concerns a predictable account-linking hash that can enable account takeover through a malicious OIDC client. CVE-2026-18963 covers an unauthenticated account takeover through a reset-credentials flow bypass.

Administrative surfaces account for three more Keycloak-specific entries. CVE-2026-14613 affects Fine-Grained Admin Permissions through the role-groups endpoint. CVE-2026-15945 allows group-hierarchy searches to disclose hidden parent groups under FGAP v2. CVE-2026-17048 concerns the Admin REST API leaking a vault-resolved rotated client secret.

The release also updates dependencies for CVE-2026-45292, an unbounded-memory issue in OpenTelemetry Java SDK W3C baggage propagation, and CVE-2026-59888 plus CVE-2026-59889 in jackson-databind. A separate weakness entry says show-config can print the vault keystore password in clear text.

The safest upgrade boundary

For upstream Keycloak, 26.7.2 is the release that explicitly carries this complete fix set. The project tells operators to consult its migration guide before upgrading. That is the defensible path for a 26.7 deployment: review migration changes, stage 26.7.2 against authentication and administrative flows, then roll the cluster without mixing server versions longer than the documented upgrade procedure requires.

The release page does not claim that every older active stream contains equivalent fixes. Operators staying on a 26.6 or distributor-maintained stream should therefore use the advisory and build published for that stream. A version with a lower number should not be treated as fixed merely because 26.7.2 exists.

That distinction matters for Red Hat build of Keycloak users: the upstream artifact and the supported Red Hat product are separate delivery channels. Apply the Red Hat advisory for the installed product version rather than replacing a supported build with an upstream binary.

What to test

Prioritize reset-credentials, account linking, administrator role-group changes, hidden-group search and client-secret rotation in pre-production. Confirm that administrative callers see only permitted groups and that rotated secrets cannot be retrieved through the REST API. Also inspect deployment and diagnostic procedures for show-config output, because upgrading the server does not erase passwords that may already have been captured in logs or support bundles.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk