Open Source Journal #2: 14 Keycloak CVEs, Patch Today Not This Weekend
Your identity server can now let an AI agent log in as you. On purpose. And the day before that shipped, the same project closed fourteen security holes, including one that kept issuing tokens to accounts you had already disabled. Issue 2 of the Open Source Journal, a news show about the software you actually host. No tutorials, no opinions, just news, every two weeks. This issue: September 21 to October 4, 2026. 219 releases went through the catalog, we kept nine. Keycloak token delegation for AI agents, fourteen Keycloak CVEs, Ollama decision models at 91 milliseconds on a laptop, Canonical moving kernel patches to weekly and the reason why, Papermerge pulled back from the archive by three new maintainers, and four upgrades that break things quietly: Zitadel, Gitea, OpenProject and Grafana. Tell us in the comments what we missed. Issue three lands in two weeks. CHAPTERS 0:00 Your identity server can let a robot in 0:09 What this show is 0:55 Keycloak 26.8.0: handing an agent your access, not your keys 2:16 What got fixed while you were sleeping: 14 Keycloak CVEs 3:20 Ollama 0.35: models that decide instead of models that talk 4:49 The debate: Ubuntu goes weekly, and AI is why 5:46 The obituary that didn't happen: Papermerge 6:32 Traps of the fortnight: Zitadel, Gitea, OpenProject, Grafana 7:36 Three things to do today ELESTIO Website: https://elest.io Catalog: https://elest.io/fully-managed-services Blog: https://blog.elest.io X: https://x.com/elest_io LinkedIn: https://www.linkedin.com/company/elestio GitHub: https://github.com/elestio SOURCES Keycloak 26.8.0, token exchange delegation https://www.keycloak.org/2026/10/keycloak-2680-released Keycloak 26.7.5, fourteen security fixes https://www.keycloak.org/2026/09/keycloak-2675-released https://www.keycloak.org/security https://github.com/keycloak/keycloak/security/advisories https://github.com/keycloak/keycloak/releases Ollama 0.35, decision models https://ollama.com/blog/ollama-now-supports-jev-style-decision-models https://ollama.com/library/nimble https://ollama.com/library/tev1 https://github.com/ollama/ollama/releases Ubuntu kernel CVEs move to weekly https://ubuntu.com/security/notices https://ubuntu.com/security/CVE-2026-80521 Papermerge finds three maintainers https://papermerge.com/ https://github.com/papermerge/papermerge-core https://github.com/papermerge/papermerge-core/discussions Zitadel 4.19.2, two account takeovers https://github.com/zitadel/zitadel/releases/tag/v4.19.2 Gitea 28.0.0, outbound proxy and deprecated settings https://github.com/go-gitea/gitea/releases/tag/v28.0.0 OpenProject 17.9, sessions valid after a password change https://github.com/opf/openproject/security/advisories/GHSA-4p83-c4wg-59q4 https://github.com/opf/openproject/security/advisories https://www.openproject.org/docs/release-notes/17-9-0/ Grafana, four release lines patched in one day https://grafana.com/security/security-advisories/ Our fortnightly release roundups https://blog.elest.io/self-hosted-weekly-week-40-2026-gitea-28-keycloak-agent-tokens-weekly-ubuntu-kernels/ https://blog.elest.io/elestio-catalog-updates-113-new-releases-this-week-september-27-october-3-2026/ https://blog.elest.io/elestio-catalog-updates-106-new-releases-this-week-september-20-26-2026/ Run any of these fully managed https://elest.io/open-source/keycloak https://elest.io/open-source/ollama https://elest.io/open-source/zitadel https://elest.io/open-source/gitea https://elest.io/open-source/openproject https://elest.io/open-source/grafana https://elest.io/open-source/papermerge #OpenSource #SelfHosted #Homelab #SysAdmin #Keycloak