From c77d4b8e785ed25f6348150ccb0798db87371bb8 Mon Sep 17 00:00:00 2001 From: mikkeldamsgaard Date: Tue, 20 Oct 2026 20:36:40 +0200 Subject: [PATCH] chore: prepare keycloak v26.8.1 release Sync chart version with upstream appVersion 26.8.1 (bumped on main via #150). Security: ~20 upstream CVE fixes in 26.8.1. Keycloak 26.8 persists login failures in the DB (first-boot schema migration). Co-Authored-By: Claude Opus 5.5 (1M context) --- charts/keycloak/CHANGELOG.md | 2 ++ charts/keycloak/Chart.yaml | 6 ++++-- charts/keycloak/tests/serviceaccount_test.yaml | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/charts/keycloak/CHANGELOG.md b/charts/keycloak/CHANGELOG.md index 520cf10..67c393a 100644 --- a/charts/keycloak/CHANGELOG.md +++ b/charts/keycloak/CHANGELOG.md @@ -4,6 +4,8 @@ All notable changes to the Keycloak Helm chart will be documented in this file. ## Unreleased +## [26.8.1] — 2026-10-20 + ### Security - Bump Keycloak appVersion from 26.7.4 to 26.8.1 (#145, #147) diff --git a/charts/keycloak/Chart.yaml b/charts/keycloak/Chart.yaml index 77e6b2d..212f861 100644 --- a/charts/keycloak/Chart.yaml +++ b/charts/keycloak/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: keycloak description: A Helm chart for deploying Keycloak IAM using the upstream quay.io/keycloak/keycloak image on Kubernetes type: application -version: 26.7.4 +version: 26.8.1 appVersion: "26.8.1" keywords: - keycloak @@ -31,4 +31,6 @@ annotations: url: https://github.com/KitStream/helms artifacthub.io/changes: | - kind: security - description: Bump Keycloak from 26.7.2 to 26.7.4 — 26 upstream CVE fixes including CVE-2026-17526 (impersonation-role privilege escalation to realm admin), CVE-2026-16089 (auth-code retargeting), CVE-2026-16093 (signed-JWT policy bypass), and CVE-2026-79651 (unauthenticated DoS) + description: Bump Keycloak from 26.7.4 to 26.8.1 — ~20 upstream CVE fixes including CVE-2026-94000 (manage-users to realm-admin escalation), CVE-2026-94218 (2FA bypass), CVE-2026-96446 (PAR single-use bypass), and CVE-2026-97846 (token-exchange mTLS binding bypass) + - kind: changed + description: Keycloak 26.8 persists login failures in the database; the first start against an existing database runs a schema migration and background index creation diff --git a/charts/keycloak/tests/serviceaccount_test.yaml b/charts/keycloak/tests/serviceaccount_test.yaml index 69bea7f..787ab67 100644 --- a/charts/keycloak/tests/serviceaccount_test.yaml +++ b/charts/keycloak/tests/serviceaccount_test.yaml @@ -52,6 +52,6 @@ tests: - isSubset: path: metadata.labels content: - helm.sh/chart: keycloak-26.7.4 + helm.sh/chart: keycloak-26.8.1 app.kubernetes.io/managed-by: Helm app.kubernetes.io/version: "26.8.1"