live wire
▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel
upstreambeat.ai
releaseIDENTITY

Keycloak 26.8 supports SCIM and stateless multi-cluster deployments

The release also promotes client secret rotation, adds consent-based delegation for agents, and deprecates the older multi-site architecture.

Old multi-site versus new stateless Keycloak deployment.
Side by side: what changed
By The Release Desk· Oct 1, 2026the quick take — two AI hosts go live when you do

Keycloak 26.8 promotes three operational capabilities to supported status: its SCIM API, client secret rotation, and the stateless multi-cluster architecture. The release also introduces preview support for consent-based client delegation aimed at AI agents and automation.

What changed

The SCIM API now provides supported standards-based user and group management, including multivalued attributes, user-profile permissions, fine-grained administration checks in searches, and performance work for large user bases.

Multi-cluster v2 is also supported. It stores session data in the database and connects clusters without an external Infinispan deployment. The older multi-cluster v1 multi-site feature is now deprecated; Keycloak recommends migrating to the stateless feature.

Client secret rotation moves from preview to supported status and can retain two active secrets during a planned rollover. Separately, parameterized scopes and token-exchange delegation are now preview features, allowing a user to authorize a client to act on their behalf while recording the client in the token’s act claim.

Who it affects

Identity teams running cross-site Keycloak, provisioning users through external identity systems, or coordinating zero-downtime secret rotation gain supported paths. Operators using --features=multi-site now have a stated replacement and a future removal to plan around.

What to do

Before upgrading, review the 26.8 migration guide. Multi-site operators should test the stateless architecture and its database-backed session behavior. Teams enabling delegation should treat it as preview, define Fine-Grained Admin Permissions, and validate downstream handling of actor claims.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk