Keycloak 26.7

Apply the Java 25 prompt first when developing providers and extensions for a Java 25 deployment. These rules cover the Keycloak 26.7 server line and its realm, client, federation, and deployment configuration.

Version and deployment

• Run the newest Keycloak release and plan the move to each new minor release when it ships. Keycloak's security policy fixes a vulnerability in the current minor release, or in the next minor for lower-severity issues and hardening, and makes no promise for older minors, so the newest 26.7 patch stops being a safe place to stay once a newer minor is out; the policy points teams that can't follow minor releases to the Red Hat build of Keycloak for long-term support. Configuration hardening does not replace patching.
• Check a running server against Keycloak's release notes rather than trusting a scanner. Read the Security fixes and Weaknesses lists of every later patch on its line and of the next minor release, on the GitHub release page or the keycloak.org announcement, treat each listed fix as missing from the running server, and apply the matching rule in this prompt or upgrade. Most of this line's CVEs reach the GitHub Advisory Database as unreviewed entries with no package or version range, a reviewed range can stop before a follow-up CVE finished the fix, and OSV can turn a range with no first-patched version into one with no end, so a dependency or image scanner can pass an affected server and flag a fixed one.
• Match extension bytecode and APIs to the deployed JDK. Keycloak supports OpenJDK 17, 21, and 25, but its official