Tip: inventory Keycloak realms using SAML HTTP-Redirect and schedule 26.8.2 before the next federation change window
- List realms/clients with SAML and check whether Redirect is enabled on login/assertion consumer URLs.
- Upgrade staging → prod to 26.8.2+; for RHBK track the Red Hat erratum rather than community tags.
- After upgrade, re-test a known-good IdP login and watch for signature failures that would previously have been bypassable via encoded parameter names.
Sources: Keycloak 26.8.2 released · Red Hat CVE-2026-117691