Keycloak critical security update, 26.7.2 is available
Keycloak 26.7.2 is available on Clever Cloud. It fixes CVE-2026-18963, a critical vulnerability with a CVSS score of 9.1. An unauthenticated attacker can bypass the email verification step of the password reset flow, set new credentials for any user and take control of their account without user interaction.
Update or temporarily disable password resets
Update every Keycloak add-on to version 26.7.2 as soon as possible. You can update through the add-on’s dashboard in the Clever Cloud Console. You can also set CC_KEYCLOAK_VERSION of the underlying Java application to 26.7.2 and rebuild it, or use Clever Tools:
clever features enable operators
clever keycloak version check yourKeycloakNameOrId
clever keycloak version update yourKeycloakNameOrId
clever keycloak version update yourKeycloakNameOrId --target 26.7.2If you can’t update immediately, temporarily disable password resets in every realm. In the Keycloak Admin Console, select a realm, open Realm settings, then Login, switch Forgot password to Off and repeat for every realm. This prevents legitimate users from requesting a password reset; re-enable the feature only after the instance runs version 26.7.2.
If you suspect that an account was compromised before the update, reset its credentials, revoke its active sessions and review its recent activity, roles and permissions for unexpected changes.
Other security fixes
Keycloak 26.7.2 addresses seven other vulnerabilities: CVE-2026-45292, CVE-2026-14613, CVE-2026-59888, CVE-2026-59889, CVE-2026-15945, CVE-2026-17048 and CVE-2026-15571. They cover account takeover risks in account linking flows, permission bypasses and information disclosure in fine-grained admin permissions, exposure of rotated client secrets, unbounded memory allocation in OpenTelemetry baggage processing and vulnerabilities in Jackson Databind. The release also prevents show-config from displaying the Vault keystore password in clear text and fixes bugs affecting SCIM, OIDC, WebAuthn, stateless clusters and the Admin UI.