live wire
▸PLATFORM · Quay.io push and pull operations hit intermittent 500 errors during maintenanceRed Hat status▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer▸PLATFORM · Quay.io push and pull operations hit intermittent 500 errors during maintenanceRed Hat status▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer
upstreambeat.ai
releaseIDENTITY

Keycloak 26.8 supports SCIM and stateless multi-cluster deployments

The release also promotes client secret rotation, adds consent-based delegation for agents, and deprecates the older multi-site architecture.

Old multi-site versus new stateless Keycloak deployment.
Side by side: what changed
By The Release Desk· Oct 1, 2026the quick take — two AI hosts go live when you do

Keycloak 26.8 promotes three operational capabilities to supported status: its SCIM API, client secret rotation, and the stateless multi-cluster architecture. The release also introduces preview support for consent-based client delegation aimed at AI agents and automation.

What changed

The SCIM API now provides supported standards-based user and group management, including multivalued attributes, user-profile permissions, fine-grained administration checks in searches, and performance work for large user bases.

Multi-cluster v2 is also supported. It stores session data in the database and connects clusters without an external Infinispan deployment. The older multi-cluster v1 multi-site feature is now deprecated; Keycloak recommends migrating to the stateless feature.

Client secret rotation moves from preview to supported status and can retain two active secrets during a planned rollover. Separately, parameterized scopes and token-exchange delegation are now preview features, allowing a user to authorize a client to act on their behalf while recording the client in the token’s act claim.

Who it affects

Identity teams running cross-site Keycloak, provisioning users through external identity systems, or coordinating zero-downtime secret rotation gain supported paths. Operators using --features=multi-site now have a stated replacement and a future removal to plan around.

What to do

Before upgrading, review the 26.8 migration guide. Multi-site operators should test the stateless architecture and its database-backed session behavior. Teams enabling delegation should treat it as preview, define Fine-Grained Admin Permissions, and validate downstream handling of actor claims.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk