SupportConsoleDevelopersStart a trialContact

Chapter 8. Updates for 26.2.11

This release contains several fixed issues and changes related to upgrading. For details, see the Upgrading Guide. Also, this release includes a change to filtering of LDAP referrals to mitigate a CVE.

8.1. Filtering of LDAP referrals
Copy link

This release adds filtering of LDAP referrals by default. This change enhances security and aligns with best practices for LDAP configurations. If this change is unacceptable, you can disable LDAP referrals in all LDAP providers in all realms.

8.2. Deprecated: Filtering of LDAP referrals
Copy link

The option spi-storage—​ldap—​secure-referral to disable filtering referrals is deprecated. When this feature is removed in a future release, filtering will be enforced.

8.3. CVE fix
Copy link

  • CVE-2025-13467 An authenticated realm administrator can configure the LDAP User Federation provider to connect to a malicious LDAP server. By setting the connectionUrl parameter and enabling Referral: follow, the Red Hat build of Keycloak server can be forced to deserialize an untrusted Java object from a malicious RMI server during a user sync action.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top