Upgrade Keycloak from 26.1.1 to 26.6.3#693
Merged
Merged
Conversation
Keycloak 26.1 bundles pgjdbc 42.7.4, whose GSSInputStream assumes
every socket read returns a complete GSS token; when TCP segmentation
splits a token across reads the decrypt fails ('Could not use AES128
Cipher - Checksum failed') and Keycloak crash-loops. This took out
amrc-fp after routine node maintenance changed the path's
segmentation behaviour - the bug is timing-dependent, so any site
can hit it. Fixed upstream in pgjdbc 42.7.5 (pgjdbc #3373); 26.6.3
ships 42.7.11.
The SPI rebuilds against 26.6 with no source changes (80 tests
pass). The chart moves to the KC_BOOTSTRAP_ADMIN env vars replacing
the KEYCLOAK_ADMIN ones deprecated in Keycloak 26; these are only
consulted when the master realm has no admin, so the change is inert
on established installations. Keycloak migrates its schema one-way
on first start; downgrade requires a database restore.
AlexGodbehere
added a commit
that referenced
this pull request
Jul 23, 2026
Promotes the Keycloak 26.6.3 upgrade notes (#693) into a v6.1.4 section. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keycloak 26.1 bundles pgjdbc 42.7.4, whose
GSSInputStreamassumes every socket read returns a complete GSS token. When TCP segmentation splits a token across reads, decryption fails with "Could not use AES128 Cipher - Checksum failed" and Keycloak crash-loops - which is exactly what took out amrc-fp after routine node maintenance changed the path's segmentation behaviour. Fixed upstream in pgjdbc 42.7.5 (pgjdbc#3373, hardened in #3500); Keycloak 26.6.3 ships 42.7.11 (also covering CVE-2025-49146).acs-keycloak: base image 26.1.1 → 26.6.3.acs-keycloak-spi: rebuilt against 26.6.3 - no source changes needed, all 80 tests pass.KEYCLOAK_ADMIN/KEYCLOAK_ADMIN_PASSWORD→KC_BOOTSTRAP_ADMIN_USERNAME/KC_BOOTSTRAP_ADMIN_PASSWORD(deprecated replacements; only consulted when the master realm has no admin, so inert on established sites).Migration notes 26.2-26.6 reviewed against our surface: probes (
/health/*on 9000) unchanged,start --optimized=falsefine under the stricter validation, jgroups/JDBC_PING unchanged, custom login theme only uses its ownresourcesPath(the 26.3 common-resource reshuffle doesn't touch it - verify visually on first deploy), service-setup admin API usage unaffected.Verified: image builds with the SPI via the CI build contexts,
kc.sh buildaccepts the providers (same benign internal-SPI warnings as 26.1), bundled driver confirmed as pgjdbc 42.7.11.How to test
fp_principal_uuidis present;?auth_token=login still works.🤖 Generated with Claude Code