# Keycloak 26.5.0 released

DevFeed: [Keycloak 26.5.0 released](<https://devfeed.tech/articles/keycloak-26-5-0-released-31746.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/01/keycloak-2650-released>)

Author: Keycloak Team

Published: 2026-01-06T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [OpenTelemetry](<https://devfeed.tech/topics/opentelemetry.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Cross-origin resource sharing (CORS)](<https://devfeed.tech/topics/cors.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [cors](<https://devfeed.tech/tags/cors.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [opentelemetry](<https://devfeed.tech/tags/opentelemetry.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.5.0 introduces workflows for realm administration, JWT Authorization Grants in preview, additional documentation for using Keycloak as an authorization server for MCP servers, Kubernetes service-account-token authentication, and OpenTelemetry support for metrics and logging. It also includes CORS enhancements and other identity-management changes.

## Source excerpt

To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Workflows to automate administrative tasks and process within a realm. JWT Authorization Grants, our recommended alternative to external to internal token exchange. Guide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers. Authenticating clients with Kubernetes service account tokens to avoid static client secrets. OpenTelemetry support for metrics and logging, combining all observability information in this popular standard. Read on to learn more about each new feature. If you are upgrading from a previous release, review also the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (preview) Keycloak 26.5 introduces a new feature called JWT Authorization Grant, which adds support for RFC 7523 to use external signed JWT assertions to request OAuth 2.0 access tokens. To accept signed JWT assertions, a trust relationship must be established between the external provider and Keycloak. This trust relationship can be configured through an identity provider in a dedicated section of the OpenID Connect v1.0 identity provider, or through the new JWT Authorization Grant identity provider. JWT Authorization Grant is recommended as an alternative to External to internal token exchange V1. This feature is in preview, and additional details are available in the dedicated documentation. Using Keycloak as an authorization server for Model Context Protocol (MCP) servers Using Keycloak as an authorization server for Model Context Protocol (MCP) servers is becoming popular, so this release ships additional documentation on how to do this. See Integrating with Model Context Protocol (MCP) for the new guide. Many thanks to Takashi Norimatsu for the contribution. CORS enhancements CORS (Cross Origin Resource Sharing) is a browser security feat