Keycloak 26.7.1: all 12 CVEs fixed (7 not in the release notes)
· Security · IDPTrust
Keycloak 26.7.1 is a security update released on August 5, 2026. The official release notes list 5 CVEs, but the real count is 12: the next day, GitHub published 7 additional advisories that are also fixed in Keycloak 26.7.1. If you go by the release notes alone, you're seeing less than half of the vulnerabilities this update patches.
This guide covers all 12 CVEs in Keycloak 26.7.1, ranked by severity, with their CVSS score, the affected component, and a clear upgrade recommendation.
Quick answer: what does Keycloak 26.7.1 fix?
Keycloak 26.7.1 fixes 12 vulnerabilities (CVEs) in total: 5 documented in the release notes and 7 published as GitHub security advisories on August 6, 2026. The same fixes are available in versions 26.6.5 and 26.4.14. The two most severe (CVE-2026-15572 and CVE-2026-16102, CVSS 8.8 and 8.1) allow a privilege escalation to full realm admin through Dynamic Client Registration. Upgrading immediately is recommended.
Keycloak 26.7.1 CVE summary table
| CVE | CVSS | Severity | Component | In official notes? |
|---|---|---|---|---|
| CVE-2026-15572 | 8.8 | Critical | Dynamic Client Registration | No (GitHub advisory) |
| CVE-2026-16102 | 8.1 | High | Dynamic Client Registration | No (GitHub advisory) |
| CVE-2026-15573 | 8.1 | High | Authorization Services (PathMatcher) | No (GitHub advisory) |
| CVE-2026-16443 | 7.4 | High | SAML identity brokering | No (GitHub advisory) |
| CVE-2026-16442 | 7.4 | High | SAML identity brokering | No (GitHub advisory) |
| CVE-2026-16100 | 6.5 | Medium | User-event metrics | No (GitHub advisory) |
| CVE-2026-16071 | 5.4 | Medium | LDAP storage provider | No (GitHub advisory) |
| CVE-2026-9793 | — | — | OIDC (request object) | Yes |
| CVE-2026-4629 | — | — | Client management (role mapper) | Yes |
| CVE-2026-14209 | — | — | Admin UI / FGAP v2 | Yes |
| CVE-2026-14614 | — | — | Client scopes / FGAP | Yes |
| CVE-2026-14615 | — | — | Groups / FGAP v2 | Yes |
All GitHub advisories list 26.4.14, 26.6.5, and 26.7.1 as patched versions.
The most critical Keycloak 26.7.1 vulnerabilities
CVE-2026-15572 (CVSS 8.8) — Protocol mapper type-swap in DCR
The Allowed Protocol Mapper Types policy in Dynamic Client Registration restricts which mapper types a client can use. The flaw is that Keycloak fails to re-validate the mapper type on a client update if the mapper's configuration hasn't changed.
An attacker with client registration privileges first registers an allowed mapper type with a malicious configuration, then swaps it for a restricted, high-privilege type (for example, one that hardcodes administrative roles). The result is full administrative access to the realm. This is the most severe CVE in the release.
CVE-2026-16102 (CVSS 8.1) — Role forgery via User Property mappers
Another flaw in the default Dynamic Client Registration policy: it fails to properly validate the claim path for User Property mappers, allowing them to write values into sensitive internal claim locations.
An attacker with a standard user account and a limited Initial Access Token can forge administrative roles in their own access token, take over other clients, steal confidential secrets, and potentially gain full administrative control of the realm.
CVE-2026-15573 (CVSS 8.1) — Authorization bypass via unnormalized URIs
The PathMatcher component in Authorization Services, which matches request paths against security policies, does not normalize URIs before comparing them. By adding a trailing slash or matrix parameters to a URL, an attacker gets a less restrictive policy applied than intended and reaches administrative or restricted areas they shouldn't see.
SAML CVEs: two identity brokering flaws
Both rated CVSS 7.4, and both relevant if you run Keycloak as a broker in front of an external SAML IdP.
- CVE-2026-16443 (CVSS 7.4) — When importing identity provider metadata whose keys lack specific usage attributes, Keycloak disables signature validation for SAML responses even when a signing certificate is provided. An unauthenticated attacker who knows a user's external identifier can forge a SAML response and gain access to that account.
- CVE-2026-16442 (CVSS 7.4) — IdP-initiated SAML login bypasses the link-only restriction, which is supposed to limit that provider to linking existing accounts without allowing direct sign-in. The result is that a user can authenticate through a path the administrator believed was disabled.
Remaining GitHub security advisories
- CVE-2026-16071 (CVSS 5.4) — In the LDAP storage provider, a search by Distinguished Name allows lookups for users located outside the configured search boundary, disclosing account information from unauthorized parts of the directory and unintentionally importing those users into local storage. It mainly affects delegated administration setups.
- CVE-2026-16100 (CVSS 6.5) — Unbounded cardinality in user-event metrics. With metrics enabled, Keycloak records raw error messages as Prometheus labels, and those messages include user-supplied input (nonexistent client IDs, for instance). An authenticated user can generate a huge number of unique metric series until memory is exhausted and the service goes down (denial of service).
The 5 CVEs from the official Keycloak 26.7.1 notes
- CVE-2026-9793 — A JWE request object bypasses
requestObjectSignatureAlgenforcement in OIDC. The signature algorithm you configured as mandatory stops being enforced once the request object arrives encrypted. - CVE-2026-4629 — Privilege escalation through injection of a role mapper with hardcoded roles into clients manageable with
manage-clients. - CVE-2026-14209 — User disclosure through the Admin UI
brute-force-userextension usingsearch=id:under Fine-Grained Admin Permissions (FGAP) v2. - CVE-2026-14614 — FGAP bypass in client scope assignment, present since 26.6.3.
- CVE-2026-14615 — In FGAP v2, the parent group children endpoint doesn't apply the per-child view permission filter, so it returns groups the administrator shouldn't be able to see.
Three of these five touch FGAP v2, in the same vein as the admin console privilege escalation we covered earlier. If you delegate administration through fine-grained permissions, review this release carefully.
Bug fixes in Keycloak 26.7.1
Beyond security, 26.7.1 fixes six bugs:
- The WebAuthn authenticator attachment policy was ignored when the client omitted the
attachmentfield. - The new password was committed when multiple simultaneous password resets were detected.
- A 500 error when a client requests the
organizationscope while it's already set toDefault. IllegalFormatConversionExceptioninLiquibaseDBLockProviderFactory, with incorrect time conversion.- Faulty Role and RoleBinding in the cluster-wide Operator installation via kustomize (one of the new features in 26.7.0).
- A broken clustering test in the 26.7 release branch.
How to upgrade to Keycloak 26.7.1
Before upgrading, review the official migration guide. Being a patch release on top of 26.7.0, there are no significant functional changes, but if you're coming from 26.6.x or earlier you also take on the 26.7.0 changes (Identity Brokering API v1 deprecated, Twitter IDP deprecated, database schema updates). We covered them in our Keycloak 26.7.0 post.
If you can't move to the 26.7 branch, the same security fixes are available in 26.6.5 and 26.4.14, so you can apply the patch without changing major branch.
Should you upgrade to Keycloak 26.7.1?
Yes, and don't push it to the next wide maintenance window. The two Dynamic Client Registration flaws (CVE-2026-15572 and CVE-2026-16102) take an attacker with modest privileges all the way to administrative control of the realm, and neither requires anything exotic to exploit. If you have dynamic client registration open, even gated behind an Initial Access Token, that's your priority.
After that, in order: the PathMatcher bypass if you use Authorization Services, the two SAML flaws if you broker against an external IdP, and the FGAP v2 group if you delegate administration.
Keycloak 26.7.1 FAQ
How many CVEs does Keycloak 26.7.1 fix?
Keycloak 26.7.1 fixes 12 CVEs: 5 documented in the official release notes and 7 published as GitHub security advisories on August 6, 2026.
What is the most severe vulnerability in Keycloak 26.7.1?
The most severe is CVE-2026-15572 (CVSS 8.8), a protocol mapper type-swap in Dynamic Client Registration that lets an attacker with client registration privileges escalate to realm admin.
Which other versions include these patches?
The same security fixes are available in Keycloak 26.6.5 and Keycloak 26.4.14, in addition to 26.7.1.
Is it urgent to upgrade to Keycloak 26.7.1?
Yes. Two vulnerabilities allow a privilege escalation to realm admin with modest exploitation requirements. Upgrading immediately is recommended, especially if you have Dynamic Client Registration enabled.
Full release notes: keycloak.org/2026/08/keycloak-2671-released
Full security advisories: github.com/keycloak/keycloak/security/advisories
At IDPTrust we specialize in Keycloak in production. If you need help assessing the impact of this release on your environment or planning the upgrade, get in touch.