The announcement text on keycloak.org is two sentences: a download link and a pointer to the migration guide. Underneath them sits the categorized issue list — the same list in the tag body and in the releases feed, the surfaces this site once misread once and then corrected. What the announcement never carries: a count, a severity, an affected version. This site parsed the release object directly. Here is the reconciliation.

The count

The tag was created 15:27:24Z on November 5 and published at 16:00:19Z. It sits 63 commits ahead of 26.8.1. Its body carries four sections:

  • Security fixes: 33 CVE identifiers fixed, with three more identifiers appearing inside other fixes' titles as the prior CVEs their fixes failed — CVE-2026-9099, CVE-2026-16102, and CVE-2026-7307. Every identifier from the twenty that 26.8.1 carried on October 13 is absent here: the lists share zero identifiers, so this is not a restatement of an older batch, it is thirty-three new ones.
  • Weaknesses: 5 security-relevant fixes with no CVE numbers — an unsigned SAML client able to impersonate another client's Issuer on back-channel logout and kill its sessions realm-wide, a JWE key-management algorithm never checked against the provisioned key, a URI-normalization hardening, hidden-client disclosure in FGAP v2 session statistics, and an unverified broker email satisfying an organization domain gate.
  • Enhancements: 1 — the Quarkus 3.40.1.1 upgrade. The brotli row sits in Security fixes against the bundled decoder in the Quarkus distribution; read together, the bump is the fix.
  • Bugs: including a non-atomic replace in GzipResourceEncodingProvider that intermittently 404s theme resources on a cold cache — the same provider as the unauthenticated disk-exhaustion CVE below; an open-UDP-socket leak; a user-storage sync running at double the configured interval; and the admin-permissions client being internalized so delegated client admins can no longer rewrite an FGAP v2 realm's authorization model.

Series arithmetic on the 26.8 line, using each body's own counts: 26.8.0 shipped six identifiers, 26.8.1 shipped twenty, 26.8.2 ships thirty-three — fifty-nine identifiers in five weeks on one minor line, plus 104 CVE-less weakness fixes across the three tags (84 + 15 + 5). Thirty-three makes this the largest single-tag batch this site has ledgered for the project; the previous high was twenty, which the cadence reached twice, once at 26.7.3 and once at 26.8.1.

The advisory databases remain unusable for this batch. Every row this site pulled at publish time: CVE-2026-112208 (the account-takeover item, high, CVSS 8.1) — affected None, patched None. CVE-2026-117691 (the SAML identifier, critical, CVSS 9.1) — affected None, patched None, advisory published five minutes after the tag was cut. CVE-2026-109081 (the default-roles injection, medium, 6.8) — affected None, patched None, advisory published the morning after the release, November 6 at 06:30 UTC. CVE-2026-96457 — the regression CVE — had no published advisory at all at check time. The one row that carries a version range is the brotli library advisory (>= 1.0.3, < 1.2.1), and even it says patched None — the same "affected Unknown, patched Unknown" ledger this site has now recorded across four consecutive Keycloak batches. A scanner keyed on version ranges returns nothing for a Keycloak deployment. The release body is the ground truth, again.

The bounty is visible in the identifiers

Six of the thirty-three — CVE-2026-97367 (DCR claim substitution → session takeover), CVE-2026-97174 (CIBA sub injection → victim tokens), CVE-2026-114232 (UMA cross-owner access), CVE-2026-97847 (client-manager principal replacement → realm takeover), CVE-2026-109081 (create-client → default-roles injection), CVE-2026-96448 (FGAP v2 composite-blind role mapping → realm-admin wrapper) — carry #YWH-PGM40475 report numbers in their titles: 256, 289, 290, 292, 306, 313. Sequential numbers inside one window means one intake process; the YWH prefix means YesWeHack's bug-bounty platform. Nothing in the announcement or the migration guide mentions a program. The audit trail lives in the identifiers, where nobody's tooling looks for it — the same channel-without-CVE-numbers observation this site made about the Weaknesses section, now repeated one level up.

Three fixes that did not hold

  • CVE-2026-96457 — a regression. The issue title names it directly: "Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)." A fix previously shipped to stop group-administrators from bypassing DENY policies re-opened the door through group moves.
  • CVE-2026-97848 — a bypass of a bypass fix. "Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response." The same protocol-mapper seam, failing a different way. The project's answer this time is deeper than one code change: the migration guide restricts protocol-mapper management to realm administrators entirely — see the config section below.
  • CVE-2026-110931 — an incomplete fix. Single-request JVM termination via a SAML 1.1 AuthorityBinding parser loop, titled "incomplete fix of CVE-2026-7307." This one rides a codepath the migration guide describes in words no vendor usually admits to: SAML 1.1 "has never been supported by {project_name}. However, parsers for the SAML 1.1 version have been enabled by mistake."

This is the third consecutive batch-shaped instance in the ledger: 26.7.3 carried twenty identifiers with two of them fixing fixes, 26.7.5's brute-force family included another incomplete-fix round of CVE-2026-9798, 26.8.1 named an incomplete fix of the 26.7.2 hardening inside its own list. A project shipping this rate of protocol complexity will keep producing fixes that fail; the useful operator trait is assuming the previous tag's patch list is provisional, not settled.

What you are running until then

The batch's shape matters for the installed base: identity providers are public endpoints, and much of this list needs no credentials at all.

Unauthenticated availability failures, all on the login surface:

  • CVE-2026-110932 — unauthenticated persistent disk exhaustion via the theme gzip cache; the issue title claims affected "Keycloak <= 26.8.0" while the fix lands in 26.8.2. Either the title is wrong about 26.8.1 or the granularity is sloppy — the safe posture is to treat any pre-26.8.2 tag as carrying it.
  • CVE-2026-107123 — unauthenticated SAML endpoint DoS.
  • CVE-2026-107602 — unauthenticated CPU and worker-pool exhaustion ("restart required") via a SAML 1.1 KeyInfo parser loop, triggered on a legal ds:KeyName.
  • CVE-2026-82965 — unbounded XML parsing on the SAML /resolve SOAP endpoint. The migration guide caps all SAML SOAP requests at 120000 bytes by default.
  • CVE-2026-110931 — single request, JVM dead, from the incomplete fix above.

Two of the three SAML-1.1 parser loops disappear entirely with the "SAML 1.1 parsers disabled by default" change, which for a never-supported protocol is the correct default. Community identity deployments should read that list and stop calling their login page a back-office service: several of these are one-request failures.

The takeover family:

  • CVE-2026-112208 — account takeover via stale SSO_AUTH note in organization identity-first login, "reproduced on 26.8.1" per the issue title — the tag most of the installed base runs today.
  • CVE-2026-107124 — session takeover by injecting id_token_hint into a victim logout.
  • CVE-2026-97174 — CIBA sub parameter injection: attacker authentication mints victim tokens.
  • CVE-2026-117691 — SAML redirect-binding signature bypass via a percent-encoded parameter name (%53AMLResponse), broker login as any user, critical, 9.1. This is the third instance of the parser-divergence class this site has logged in the SAML redirect binding — 26.8.1's Weaknesses closed the semicolon variant of it.
  • CVE-2026-97175 — unverified IdP email auto-linking straight into account takeover.
  • CVE-2026-103112 — account takeover via authentication race.

The delegation seam keeps leading the count. This site has tracked that seam since 26.7.4's support-staff role escalation: accounts elevated by scoping, not compromise. This batch adds six more entries to it (97847, 109081, 96448, 96457, 96460 token-exchange unlimited expiry, 19688 missing admin-API audience check) plus five weaknesses. Upgrading closes the holes; it does not audit a delegation tree configured in good faith under the old semantics.

And the brotli receipt. CVE-2026-111497 is the brotli decoder itself, exploited in the wild, the same C code that ships in python, php, and node. Keycloak's Quarkus distribution bundles the decoder and the project closes it here via the single enhancement in the list — the Quarkus 3.40.1.1 bump. Every identity server was one more bundling surface to audit; this is the loop closing. Note what the advisory still does not say: a patched version. The fix is real in the tag; the machine-readable record of it does not exist.

The migration guide is where the deployment risk is

The 295-line behavior-change document carries more operational weight than the thirty-three identifiers. The items that will bite community deployments:

  1. Protocol mapper management is now realm-administrators-only by default. Delegated administrators who only manage clients lose create/update/delete on protocol mappers. The new Allowed protocol mapper types for client administrators realm setting is empty by default — read that as: after upgrading, your delegated client admins can manage no mapper types until you enumerate them, and the guide warns that granting this is granting token-claim shaping.
  2. DCR mapper types become the intersection of the realm-level setting and the Client Registration Policies list. With the realm level empty, dynamic client registration cannot add, modify, or delete protocol mappers at all. If a community's apps register themselves through DCR with mappers — several self-hosting stacks do exactly this — those flows break at upgrade.
  3. The Admin API now enforces an audience check (kc-admin-api built-in scope, RFC 9700 alignment). Built-in clients keep working; your own CLI scripts and service-account clients will get 401 until you add the kc-admin-api scope to them. Automation that fetches admin tokens at maintenance time will fail at exactly the moment you are busy. There is a disable flag; the guide discourages using it.
  4. One change forbids rolling upgrades. The new default-roles/full-scope client registration policy providers (CVE-2026-109081's fix) are unknown to earlier 26.8.x nodes: "shut down the cluster and upgrade all nodes together." For the three-node community installs where the maintenance window was supposed to be zero-downtime, this release is a planned outage.
  5. SAML 1.1 parsing off by default; SOAP request cap 120000 bytes. Both defaults carry the DoS fixes; raise the cap only with the spi-login-protocol--saml--max-soap-message-request-size option, after measuring.
  6. SAML broker hardening with behavior changes: an assertion must now carry a validating bearer SubjectConfirmation (CVE-2026-92855 — Keycloak cannot verify holder-of-key proof-of-possession, so such assertions could be replayed as bearer credentials); ProxyRestriction assertions are now rejected by default with an opt-out switch (CVE-2026-92856); and the SAML adapter now validates the Issuer against the configured IdP entity ID (CVE-2026-93998) — existing adapters configured with the old entityID="idp" placeholder break and their login failures will look like outages. The guide's answer: re-download the adapter configuration and paste the real realm URL.
  7. Token exchange tokens can no longer outlive the subject token (CVE-2026-96460), with an opt-out switch — and an honest warning that a refresh-token path still lets clients stretch lifetime if you enabled both options.
  8. CIBA request parameters named sub, iss, aud (and seven more reserved names) are rejected — rename application-specific parameters before upgrading (CVE-2026-97174's fix).
  9. Organization domain membership now requires a verified email, and the guide's first instruction is: configure and test outgoing SMTP before upgrading. IdPs that do not set email_verified need Trust Email enabled deliberately — the guide says not to enable it just to bypass verification — or auto-link flows fail (CVE-2026-97175's fix).
  10. Back-channel SAML logout via SessionIndex now requires the initiating client to have client signatures enabled. Realm-JSON-imported unsigned clients are the named affected group.
  11. kcadm/kcreg custom truststores stop trusting un-imported self-signed certificates (CVE-2026-96453's fix) — import the server cert in the staging runbook the same day you upgrade.

Plus the quieter ones: logout sessions carry new anti-reuse notes (CVE-2026-107124's fix) with a mid-logout restart across mixed-version nodes; admin-permissions becomes fully internal (the delegated-admin 403 from the Bugs section); user-storage sync runs at the configured period again — re-check any interval you halved to compensate; the gzip cache replacement is atomic, closing the cold-cache 404s next to the disk-exhaustion CVE.

What to actually do

  1. Any 26.8.x: upgrade to 26.8.2. Any 26.7.x: there is no 26.7.6 — jump to 26.8.2. No released 26.7 or 26.8.0/26.8.1 tag carries any of these thirty-three identifiers, and nothing in the advisories will tell you so: the non-overlap this site verified by identifier diff is the only version map that exists for this batch.
  2. Read the migration guide before the CVE list. The deployment risk in this release is mostly in behavior changes 1–6 above, not in the identifier count.
  3. Inventory your admin-token automation first. Every cron job, script, and CI step that obtains an Admin REST API token via its own client needs the kc-admin-api scope assigned before the upgrade, or your maintenance automation 401s during the window.
  4. Plan a full-cluster stop, not a rolling upgrade. The registration-policy change forbids the rolling path for this tag.
  5. If you cannot upgrade today: this batch's worst items are unauthenticated and sit on a public endpoint, so rate-limit and cap request sizes on the SAML protocol paths at your reverse proxy — and be plain about what that does not buy you: the SSO_AUTH account takeover (112208), the email auto-linking takeover (97175), and the forged-token class have no proxy-side containment; disabling organization auto-membership and unverified-IdP auto-linking while you wait is the honest mitigation.
  6. After upgrading, audit the delegation you configured earlier. List groups that map administrative roles, list every realm with delegated client administrators, and decide deliberately which mapper types they may now (not) manage — the new default is none.
  7. Do not wait for scanners. The advisory rows are blank for this batch as they were for the last three. The release body and the tag diff are the version map. That is the auditability FOSS promises working as designed — visible to anyone, carried by no system whose job it was supposed to be.

Sources: Keycloak 26.8.2 release blog (announcement text: download link + migration-guide pointer); release object via API (11,501-character body; Security fixes 33 identifiers / Weaknesses 5 / Enhancements 1; created 2026-11-05T15:27:24Z, published 16:00:19Z); 26.8.1...26.8.2 compare (63 commits ahead); changes-26_8_2.adoc (295 lines, 15+ behavior changes; quotations verified); advisory spot-checks GHSA-r493-gfv4-ggf5 (CVE-2026-112208, high 8.1, affected/patched None), GHSA-c85j-3hq2-q6wj (CVE-2026-117691, critical 9.1, affected/patched None), GHSA-5g6f-qmff-3rjc (CVE-2026-109081, medium 6.8, affected/patched None, published 2026-11-06T06:30:22Z), CVE-2026-96457 absent from the database at check time, GHSA-9v8h-qqgm-4m35 (brotli library, critical 9.8, affected >= 1.0.3 < 1.2.1, patched None); internal ledger: 26.7.3, 26.7.5, 26.8.1 correction, brotli decoder, 26.7.4 delegation seam.