Keycloak Versions: Latest Release, History, and Upgrade Guide

Last updated: July 2026

The latest version of Keycloak is 26.7.0, released on July 9, 2026. It ships a preview of the native SCIM API, experimental multi-cluster high availability, and SAML step-up authentication. Keycloak has no LTS release: only the newest version receives active development and security fixes, so the current version is always the one you should be running.

What is the latest version of Keycloak?

Keycloak 26.7.0 came out on July 9, 2026, and it is the only version the project actively maintains (keycloak.org). If you are standing up a new deployment today, this is the version to install.

Three additions define this release:

• SCIM API (preview): Keycloak now exposes a native SCIM endpoint behind the scim-api feature flag, so HR systems and identity providers can provision users without a third-party extension.
• Multi-cluster high availability v2 (experimental): a second iteration of running Keycloak across multiple clusters for site-level failover.
• SAML step-up authentication: SAML service providers can now request a higher authentication level mid-session, something OIDC clients have had for a while.

If Keycloak itself is new to you, start with our complete guide to Keycloak and come back when you need version specifics. This page tracks exactly that: what’s current, what changed in each release, and how to move between them.

Keycloak version history

The table below covers every minor release back to early 2024, with the features that defined each one. Versions and dates are from the official keycloak.org release announcements, checked July 2026.

Two patterns are worth noticing. First, features land as experimental or preview, then graduate to supported a release or two later: Organizations went preview in 25.0 and supported in 26.0, Workflows went preview in 26.5 and supported in 26.6. A “preview” label in today’s release notes is a decent forecast of next quarter’s headline feature, which makes the table useful for planning, not just history.

Second, the recent releases are heavy on standards work. RFC 8693 token exchange, RFC 7523 JWT grants, FAPI 2 Final, DPoP, and OpenID4VCI all arrived within about 18 months. That run has quietly made Keycloak one of the most spec-complete open source identity servers you can deploy.

How long is each Keycloak version supported?

Until the next one ships. That is not a joke: the maintainers state that only the latest version receives active development and security fixes (SECURITY.md, and the maintainers’ own comments in this GitHub discussion). There is no community LTS branch. The day 26.7.0 was released, 26.6 stopped being a patch target.

This is the part of self-hosting Keycloak that catches teams off guard. A CVE announced next month gets fixed in 26.7.x only. If you are still on 26.4, the fix is a minor upgrade away, not a drop-in patch, and minor upgrades come with migration notes to read and config changes to absorb. Budgeting for roughly quarterly upgrades is part of the honest cost of running Keycloak yourself.

If you need a guaranteed support window, that is what Red Hat sells. Red Hat build of Keycloak (RHBK) supports the 26.x line for a minimum of two years, moving to three years for 27.x and later (Red Hat lifecycle policy). RHBK minor versions track the even-numbered upstream minors, and each RHBK minor is patched for roughly 12 months.

How often does Keycloak release new versions?

Minor releases arrive roughly quarterly. The last four landed on September 30, 2025 (26.4), January 6, 2026 (26.5), April 8, 2026 (26.6), and July 9, 2026 (26.7). Patch releases fill the gaps as bugs and CVEs come up: 26.6.4 shipped on June 26, 2026, less than two weeks before 26.7.0 arrived.

In practice, plan for four minor upgrades a year plus patch releases as they appear. Since 26.6, patch releases support zero-downtime rolling updates, which takes most of the sting out of the in-between releases. More on that below.

How do I check which Keycloak version I am running?

Three quick options. From the command line, in your Keycloak installation directory:

bin/kc.sh --version

In the Admin Console, open the user dropdown in the top-right corner and choose Server info; the version sits at the top of the Info tab. The version is also printed in the startup logs on every boot, which helps when you are diagnosing a container you cannot exec into.

How do I upgrade Keycloak?

The official upgrading guide prescribes a fixed order: review the migration changes for your target version, upgrade the server, then upgrade adapters and client libraries. The order matters because configuration options get renamed or removed between minors, and discovering that from a crash loop is no fun.

Before touching anything:

1. Back up the database. The schema is not backward compatible. Once a new version has migrated it, there is no downgrade path other than restoring the backup.
2. Shut down every node running the old version. Mixed-version clusters are not supported for minor upgrades.
3. Read the migration changes for every version you are skipping. The guide does not require stepping through each minor release. Jumping from 26.4 straight to 26.7 is fine, but you own the migration notes for 26.5 and 26.6 too.

The database schema migration itself is automatic: the new version detects the old schema on startup and updates it. Two caveats. On tables with more than 300,000 rows, Keycloak skips creating new indexes during automatic migration so startup does not lock the table, and you create those indexes manually afterwards. And if your DBA prefers to review changes first, manual migration mode writes the SQL to a keycloak-database-update.sql file instead of applying it.

Since 26.6, patch releases (26.7.0 to 26.7.1, for example) support zero-downtime rolling updates, so nodes can be replaced one at a time without logging anyone out. Minor upgrades still require the full shutdown-first procedure.

Minor upgrades also occasionally change server behavior in ways that surface at the network edge: the hostname v1 removal in 26.0 broke plenty of proxy setups. After a version jump, it is worth re-checking your reverse proxy configuration against the current options.

If you would rather skip this quarterly ritual entirely, version upgrades are one of the things Skycloak’s managed hosting handles for you, and the docs cover the platform details.

Which Docker image and tag should I use?

The official image lives at quay.io/keycloak/keycloak. A latest tag exists, but all official production guidance pins an exact version (Keycloak containers guide):

docker pull quay.io/keycloak/keycloak:26.7.0

Pinning matters more with Keycloak than with most software. Upgrades are supposed to follow the review-then-shutdown procedure above, and a surprise minor upgrade because latest moved under you is exactly the failure mode to avoid. If you are putting together a stack, our Keycloak Docker Compose generator outputs a pinned version with a sane database configuration.

Frequently asked questions

What is the latest version of Keycloak?

Keycloak 26.7.0, released on July 9, 2026. It adds a native SCIM API in preview, experimental multi-cluster high availability, and SAML step-up authentication. Minor releases arrive roughly quarterly, and this page is updated with each one.

Is there a Keycloak LTS version?

No. The community project maintains only the latest release, and older versions stop receiving security fixes the moment a new one ships. The closest thing to an LTS is the commercial Red Hat build of Keycloak, which supports the 26.x line for at least two years and 27.x and later for three.

How do I check which Keycloak version I am running?

Run bin/kc.sh --version from the installation directory, or open the Admin Console user dropdown and choose Server info. The running version is also printed in the startup logs on every boot.

Can I skip versions when upgrading Keycloak?

Yes. The official upgrading guide does not require moving through each minor release, so 26.4 to 26.7 in one jump is supported. You must still read the migration changes for every skipped version, back up the database first, and shut down all old-version nodes before starting the new one.

What is the difference between Keycloak and Red Hat build of Keycloak versions?

Red Hat build of Keycloak (RHBK) is the commercially supported distribution of the same codebase. Its minor versions track the even-numbered upstream minors, each RHBK minor is patched for roughly 12 months, and the 26.x line carries a minimum two-year support commitment. Community Keycloak patches only the latest release.

This page is updated with each Keycloak release. Facts last checked against keycloak.org on July 17, 2026.