What is the latest Keycloak version in 2026?

Keycloak 26.8.2, released on 5 November 2026, is the current community release. Keycloak has stayed on the 26 major line through 2025 and 2026 and adds features in minor releases: Organizations became supported in 26.0, passkeys, DPoP and FAPI 2 Final in 26.4, and zero-downtime patch releases in 26.6. The commercially supported Red Hat build of Keycloak trails the community line; its current advisories cite 26.6 and 26.4 streams.

Is Keycloak a CNCF project?

Yes. Keycloak was accepted to the Cloud Native Computing Foundation on 10 April 2023 at the Incubating maturity level, and it is still listed as Incubating in November 2026. It has not graduated. Red Hat remains the main sponsor and sells the Red Hat build of Keycloak, the supported distribution that replaces future Red Hat Single Sign-On releases. The project is licensed under Apache 2.0.

How secure is Keycloak, and how often does it need patching?

It needs patching often. The 26.8.2 release on 5 November 2026 alone lists more than 30 CVE fixes, many in SAML brokering, dynamic client registration and token exchange. Earlier 2026 flaws include CVE-2026-18963, a CVSS 9.1 reset-credentials account takeover fixed in 26.7.2, and SAML broker issues CVE-2026-2603 and CVE-2026-18967. Plan for patch releases every few weeks, use the rolling update support, and disable SAML or DCR features you do not use.

What are the best Keycloak alternatives?

Zitadel is the closest modern open-source alternative, API-first with built-in multi-tenancy and a managed cloud. Ory suits teams that want composable components and relationship-based authorization. Authentik is popular for homelab and small-team self-hosting. FusionAuth offers a downloadable server with commercial support. If you want no operations at all, a managed CIAM or workforce IdP removes the patching burden that comes with running Keycloak.

Open-Source IAM

Keycloak

Name: Keycloak review
Item: Keycloak
Rating: 4.2
Author: SWI Community Team

Founded 2014Distributed (Red Hat / CNCF)Open source (CNCF, sponsored by Red Hat)Score 4.2/5Evaluated 2026-11-05Website ↗

Capability scores

Methodology →

Authentication: 4.5
SSO & Federation: 4.5
Authorization: 4.0
Lifecycle & Provisioning: 3.5
MFA & Passwordless: 4.0
Governance & Audit: 3.5
Developer Experience: 3.5
Deployment Flexibility: 5.0
Pricing Transparency: 5.0
Support & Ecosystem: 3.5

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

Keycloak is the most widely deployed open-source identity and access management server, a CNCF Incubating project since 10 April 2023 with Red Hat as primary sponsor, and in November 2026 it ships version 26.8.2. It provides SSO, OIDC and SAML federation, LDAP and Active Directory user federation, social login, and fine-grained authorization, all self-hosted under Apache 2.0 with no licence fee. See the open-source IAM category and the best IAM platforms.

What it is good at

Protocol coverage. Per the release notes, the 26.x line made Organizations (B2B multi-tenancy) supported in 26.0, then passkeys, DPoP sender-constrained tokens and FAPI 2 Final supported in 26.4. 26.4 also added Keycloak as an authorization server for MCP, and 26.8 added token exchange delegation for AI agents as a preview. OpenID for Verifiable Credential Issuance reached preview in 26.8. Authorization services and custom SPIs let you extend almost anything, and realms make multi-tenant setups practical.

Operations have improved. Rolling updates arrived in 26.2 and zero-downtime patch releases became supported in 26.6, which removes much of the upgrade pain that defined the Quarkus migration years.

Where it falls short

Patch volume. The 26.8.2 release fixes more than 30 CVEs in one go, concentrated in SAML brokering, dynamic client registration, token exchange and admin permissions. Briefs we track include a CVSS 9.1 reset-credentials account takeover fixed in 26.7.2, SAML from a disabled IdP, SAML assertion replay, UMA privilege escalation, and the 2024 SAML signature bypass. None are in CISA KEV. You need a team that tracks releases and patches within days.

You also own scaling, high availability, database tuning and theming. Lifecycle provisioning and governance reporting are weaker than commercial IGA tools, and the admin console has rough edges.

Pricing

Free and open source under Apache 2.0 with no paid tier; self-host at no licence cost (checked 2026-11-05, keycloak.org). Commercial support is available through the Red Hat build of Keycloak, which is quote-based, and third parties. Model the operational cost, not just licensing, with the TCO calculator.

Best for, and who should look elsewhere

Choose Keycloak when you need a full-featured IdP you can self-host with no licence cost and have platform engineers to run and patch it. For an API-first alternative, compare Keycloak vs Zitadel and FusionAuth vs Keycloak; for composable components and ReBAC, see Ory; for small-team self-hosting, Authentik.

Bottom line

The default open-source IdP for teams that can run it, with commercial-grade protocol support at zero licence cost. Budget for frequent security patching and the operational work.

Developer experience score: 56/100 on the Identity Developer Experience Benchmark (checked 2026-11-05).

Integrations: see what Keycloak documents for clouds, HR systems, SaaS apps and legacy directories in the Identity Integration Matrix.

Keycloak: frequently asked questions

What is the latest Keycloak version in 2026?: Keycloak 26.8.2, released on 5 November 2026, is the current community release. Keycloak has stayed on the 26 major line through 2025 and 2026 and adds features in minor releases: Organizations became supported in 26.0, passkeys, DPoP and FAPI 2 Final in 26.4, and zero-downtime patch releases in 26.6. The commercially supported Red Hat build of Keycloak trails the community line; its current advisories cite 26.6 and 26.4 streams.
Is Keycloak a CNCF project?: Yes. Keycloak was accepted to the Cloud Native Computing Foundation on 10 April 2023 at the Incubating maturity level, and it is still listed as Incubating in November 2026. It has not graduated. Red Hat remains the main sponsor and sells the Red Hat build of Keycloak, the supported distribution that replaces future Red Hat Single Sign-On releases. The project is licensed under Apache 2.0.
How secure is Keycloak, and how often does it need patching?: It needs patching often. The 26.8.2 release on 5 November 2026 alone lists more than 30 CVE fixes, many in SAML brokering, dynamic client registration and token exchange. Earlier 2026 flaws include CVE-2026-18963, a CVSS 9.1 reset-credentials account takeover fixed in 26.7.2, and SAML broker issues CVE-2026-2603 and CVE-2026-18967. Plan for patch releases every few weeks, use the rolling update support, and disable SAML or DCR features you do not use.
What are the best Keycloak alternatives?: Zitadel is the closest modern open-source alternative, API-first with built-in multi-tenancy and a managed cloud. Ory suits teams that want composable components and relationship-based authorization. Authentik is popular for homelab and small-team self-hosting. FusionAuth offers a downloadable server with commercial support. If you want no operations at all, a managed CIAM or workforce IdP removes the patching burden that comes with running Keycloak.

Keycloak comparisons

More Open-Source IAM vendors

All Open-Source IAM →

Casdoor4/5
Dex4/5
FreeIPA4/5
Logto4/5
Ory4/5

Last reviewed November 5, 2026By SWI Community TeamSuggest a correction How we research

By SWI Community Team · Last evaluated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.