---
title: Tip: inventory Keycloak realms using SAML HTTP-Redirect and schedule 26.8.2 before the next federation change window | ctxsec
url: https://ctxsec.com/items/tip-keycloak-saml-redirect-upgrade-26-8-2
description: "CVE-2026-117691 only bites if SAML Redirect binding is in play, but many broker setups still offer Redirect alongside POST. Find every Keycloak (and RHBK) node, confirm build \u226526.8.2 for community builds, and prefer POST binding on IdP/SP clients until the estate is patched. 26.8.2 is a broad security drop \u2014 plan a normal staging soak, not a one-CVE hotfix mindset."
status: "operational guidance (Keycloak 26.8.2 / Red Hat CVE-2026-117691)"
published: 2026-11-06
---

> CVE-2026-117691 only bites if SAML Redirect binding is in play, but many broker setups still offer Redirect alongside POST. Find every Keycloak (and RHBK) node, confirm build ≥26.8.2 for community builds, and prefer POST binding on IdP/SP clients until the estate is patched. 26.8.2 is a broad security drop — plan a normal staging soak, not a one-CVE hotfix mindset.

[← Tips & Guides](/tips) · [markdown](/items/tip-keycloak-saml-redirect-upgrade-26-8-2.md)

operational guidance (Keycloak 26.8.2 / Red Hat CVE-2026-117691)

2026-11-06

### Tip: inventory Keycloak realms using SAML HTTP-Redirect and schedule 26.8.2 before the next federation change window

- List realms/clients with SAML and check whether Redirect is enabled on login/assertion consumer URLs.
- Upgrade staging → prod to 26.8.2+; for RHBK track the Red Hat erratum rather than community tags.
- After upgrade, re-test a known-good IdP login and watch for signature failures that would previously have been bypassable via encoded parameter names.

Sources: [Keycloak 26.8.2 released](https://www.keycloak.org/2026/11/keycloak-2682-released) · [Red Hat CVE-2026-117691](https://access.redhat.com/security/cve/cve-2026-117691)