blog: Keycloak 26.7.3 released

[xgp]

Draft blog post for the Keycloak 26.7.3 release (published 2026-08-31).

Verdict in the post

No emergency window, but upgrade this week if you use external token exchange with Google or Microsoft, or fine-grained admin permissions (FGAP) v2 with delegated admins. Everything else can go in a normal cycle. Readers on 26.4, 26.5 or 26.6 have no tag carrying these fixes yet.

Tier: Notable (security-led). No CVE here is exploitable without a privileged account, an opt-in feature, or a network position, and there is no data-loss bug — so it is not an emergency. Security still leads the article because 20 CVEs and three breaking changes are what the release contains; there are no new features to lead with. Body is 800 words.

How the CVE count was derived

grep -o 'CVE-[0-9]\{4\}-[0-9]*' | sort -u | wc -l over the release body gives 22 distinct identifiers. Two of those are back-references, not fixes in this release:

• CVE-2026-9083 appears only inside the CVE-2026-19729 entry ("incomplete fix for CVE-2026-9083")
• CVE-2026-9794 appears in the Bugs section, in issue #52017 ("incomplete fix of CVE-2026-9794")

The Security fixes section has exactly 20 <li> entries, one CVE each. So: 20 CVEs fixed, 22 identifiers present. Upstream's own announcement also says 20. Severity split, taken verbatim from each advisory's severity field: 1 high, 17 medium, 1 low, 1 unrated. The table in the post is generated from advisories.json, not transcribed, and every row links both the GHSA and the CVE.

The claim a reviewer should check hardest

The post argues that the only high CVE, CVE-2026-35563 (Apache Directory LDAP API, 8.8 CVSS v4), is test-scope and does not reach a running server. This is our analysis, explicitly labelled as such in the post, not an upstream statement. Evidence:

• Every org.apache.directory.api usage in keycloak/keycloak is under util/embedded-ldap/ or testsuite/ (code search, 8 hits)
• Only util/pom.xml, testsuite/utils/pom.xml and testsuite/integration-arquillian/tests/base/pom.xml depend on embedded-ldap — no distribution module does
• federation/ldap uses JNDI (javax.naming.ldap), not the Apache Directory client API
• The commit closing it at tag 26.7.3 is "Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563", and issue #51785 in the same release reads "Multiple CVEs inherited from Apache DS used for testing"

If a reviewer disagrees, the fix is to soften that section rather than to restore an "urgent LDAP flaw" framing — the advisory's fixed version (2.1.8) is the library's, and the post says so.

Backport status: derived from tags, not advisories

19 of the 21 advisories have an empty vulnerabilities[] array (they are type: unreviewed, NVD-sourced), so no affected-version or first_patched_version data exists for the Keycloak packages. There is no backport map to read. Derived from git instead:

Branch	Newest release	Newest tag	Any 26.7.3 CVE id in its commits	Image confirmed on quay
26.7	26.7.3 (31 Aug)	26.7.3	yes	26.7.3 ✅
26.6	26.6.4 (26 Jun)	26.6.6 (11 Aug)	none in 200 commits	26.6.6 ✅
26.5	26.5.7 (2 Apr)	26.5.7	none	not published
26.4	26.4.7 (1 Dec 2025)	26.4.15 (11 Aug)	none in 200 commits	26.4.15 ✅

26.4.8–26.4.15, 26.6.5 and 26.6.6 return 200 on /git/ref/tags/{v} and 404 on /releases/tags/{v} — tagged, never announced. Images verified individually via quay.io/api/v1/repository/phasetwo/keycloak/tag/?specificTag=<v>&onlyActiveTags=true; 26.6.5, 26.6.4 and 26.4.14 returned zero tags and are not claimed in the post.

Conflicting upstream data, flagged in the post

The CVE-2026-9794 advisory (GHSA-fqjh-8322-vgrv) lists first_patched_version: 26.6.3, while issue #52017 in this release says that fix was incomplete. Its other range, <= 26.4.7, has no patched version at all. The post tells readers to trust the release notes and read the advisory directly.

What could not be verified

• Per-branch fixed versions for 19 of the 20 CVEs. No advisory ranges exist. The post says the fixes have not reached 26.4/26.5/26.6 based on tag dates and commit subjects; it does not claim a future backport version.
• CVE-2026-19729 has no published advisory, so it has no severity. Written as "unrated", with the CVE linked and "none published" in the advisory column. Not extrapolated to the rest of the release.
• Whether the ApacheDS upgrade fully addresses CVE-2026-35563 in every code path — only that the affected library is not on a distribution classpath.
• https://www.keycloak.org/docs/latest/release_notes/index.html stops at 26.7.0 and does not cover this release; the upgrading guide does. Noted in the post.
• No exploit availability or in-the-wild evidence was checked. EPSS for every advisory is below 0.008, but the post makes no claim from it.

Sources

• Release: https://github.com/keycloak/keycloak/releases/tag/26.7.3
• Upstream announcement: https://www.keycloak.org/2026/08/keycloak-2673-released
• Upgrading guide: https://www.keycloak.org/docs/latest/upgrading/#migration-changes (source of all three breaking changes)
• Release notes index: https://www.keycloak.org/docs/latest/release_notes/index.html (stops at 26.7.0)
• All 21 advisories, looked up individually in GitHub's global advisory database; each is linked from the table
• repos/keycloak/keycloak — releases, git/matching-refs/tags/26.*, commits?sha=<tag>, and code search for org.apache.directory.api / embedded-ldap
• Phase Two image tags: https://quay.io/repository/phasetwo/keycloak?tab=tags

Draft — not for merge until the test-scope argument above has been checked by someone who knows the LDAP federation code.

---

Note on this revision

This branch already carried an earlier draft of the article. This revision keeps that history and changes three things:

1. CVE-2026-35563 is re-scoped. The earlier draft carried it as an LDAP exposure and led the verdict with "upgrade this week"; the evidence above says it does not reach a running server, which moves it out of the verdict.
2. Backport status is now derived from git tags rather than left unstated, because 19 of the 21 advisories publish no version ranges. This adds the branch/tag/image table and the "26.4, 26.5 and 26.6 have no fix yet" line.
3. Length cut from 932 to 800 words, and the PR returned to draft.

[cloudflare-workers-and-pages]

Deploying phasetwo-docs with    Cloudflare Pages

Latest commit:	f71a98f
Status:	✅  Deploy successful!
Preview URL:	https://2c030cb6.phasetwo-docs.pages.dev
Branch Preview URL:	https://release-keycloak-26-7-3.phasetwo-docs.pages.dev

View logs

[xgp]

@pnzrr automated keycloak release blog post