v26.2.1

[tyson-redpanda]

Redpanda v26.2 Release Notes

Features

• Redpanda Enterprise (excludes Redpanda BYOC/Dedicated/Serverless) now supports major version rollback via ‘unfinalized’ upgrades. rpk cluster upgrade finalize and rpk cluster upgrade status manage deferred (unfinalized) major-version upgrades. (#30930)
• Shadowing from non-Redpanda Schema Registries using the HTTP Schema Registry API. rpk shadow provides support for the new Schema Registry Sync option shadow_schema_registry_api in Shadow Links. (#30860)
• Schema Registry sync shadow links now enforce the link's max_source_requests_per_second setting (default 30 requests/sec) when reading from the source registry, and honor a throttling source's Retry-After response header. (#31101)
• Schema Registry shadowing now exports its sync totals as shadow_link_schema_registry_* counters on the internal and public metrics endpoints, labelled by shadow_link_name. (#31067)
• Shadow links can now mirror RBAC roles from the source cluster to the destination. Configure role sync on the link with a sync interval and role-name filters to select which roles are kept in sync. (#30946)
• rpk now supports role_sync_options when creating a Shadow Link. (#30909)
• Shadowing now supports Cloud Topics. (#30073)
• Tiered Storage V2 beta. A new default_redpanda_storage_mode_tiered_impl cluster config (tiered_v1 | tiered_v2, default tiered_v1) selects whether the tiered value of the redpanda.storage.mode topic property refers to classic Tiered Storage or the new version of tiered storage. Tiered Storage v2 is a beta feature in v26.2. (#30966)
• New read-only redpanda.storage.mode.impl topic property reports the exact implementation of every topic's storage mode (unset|local|tiered_v1|tiered_v2|cloud), and can be supplied on topic creation to select the storage mode precisely. Topics using the tiered_v2 implementation (beta) can only be created once the whole cluster runs v26.2. (#30966)
• Schema Registry context support is now enabled by default. Subjects of the form :.context:subject are parsed into a separate context. See the upgrade considerations before upgrading clusters that may have stored literal :.-prefixed subject names. (#30365)
• Schema Registry now accepts /contexts/{context}/... prefixed URLs on all endpoints, allowing serde clients to target a non-default context by configuring their base URL (e.g. schema.registry.url=http://host:8081/contexts/.myctx). (#30189)
• Add OAUTHBEARER SASL mechanism support to rpk, enabling OIDC-based authentication for the Kafka client, admin API, and schema registry. Pass the token via --password (raw value or token:<TOKEN> format) with --sasl-mechanism OAUTHBEARER. (#30169)
• #30222 Add OAUTHBEARER SASL mechanism support to the admin API endpoint used by rpk debug remote-bundle start, enabling remote debug bundle collection against clusters configured with OAUTHBEARER authentication. (#30225)
• rpk debug remote-bundle start now supports OAUTHBEARER (OIDC) profiles. Pass the bearer token via --password (or kafka_api.sasl.password in the rpk profile) when sasl.mechanism is OAUTHBEARER. (#30277)
• Adds a new layout key to the Iceberg translation mode as a config string, in the value section. layout supports nested and flat; flat is the default and matches previous behavior. (#30917)
• Iceberg translation now supports schema registry contexts. Configure a topic to resolve schemas in a context via the redpanda.schema.registry.context topic property. (#30132)
• Added per-entity Kafka quota metrics. Set kafka_per_entity_quota_metrics to true (default false, no restart) to expose per-entity throttling and throughput counters for produce, fetch, and partition-mutation quotas. (#30832)
• Add rpk check as a new managed plugin for production readiness validation. It checks cluster health, broker configuration, security settings, replication factors, licensing, TLS, and Kubernetes resource configuration against the official production readiness checklists. Supports auto-install, upgrade, and uninstall via rpk check install, rpk check upgrade, and rpk check uninstall. (#30146)
• Add rpk k8s, a new managed plugin for interacting with Redpanda clusters running on Kubernetes. On first use, rpk auto-downloads, checksum-verifies, and caches the plugin; manage it explicitly with rpk k8s install / upgrade / uninstall. (#30833)
• Added an admin API endpoint to cancel an in-progress controller (raft0) reconfiguration. (#30918)
• Added redpanda_cluster_health_* Prometheus metrics (public and internal endpoints) exposing the same inputs as rpk cluster health, including nodes_down, leaderless_partitions, under_replicated_partitions, unhealthy_reasons, and a metadata_age_seconds freshness gauge. Disabled by default; enable with the new health_monitor_metrics_enabled cluster property. (#30769)
• Expose estimated cloud instance hardware capacity (vCPUs, memory, disk, network bandwidth, and IOPS) as Prometheus metrics, derived from the detected cloud instance type. (#30742)
• rpk --print-tree emits the full rpk command tree as a single JSON document, suited for LLMs and automation. (#30380)
• rpk redpanda admin broker list now includes a --detailed flag with additional per-path disk usage information, and supports the --format json/yaml flag. (#30096)
• Added rpk cloud auth token to print the current cloud auth token. (#29964)
• New metric vectorized_kafka_leadership_changes counts leadership changes in a topic. (#30117)
• New cluster config oidc_http_proxy_url routes OIDC discovery and JWKS fetches through an HTTP forward proxy. Set to a URL of the form http://host:port or https://host:port to enable; leave unset (the default) to connect to the OIDC endpoint directly. Live-reloadable, no broker restart required. (#30268)
• New cluster configs oidc_http_proxy_username / oidc_http_proxy_password add HTTP Basic authentication to the OIDC forward proxy; (#30738)
• New configuration iceberg_rest_catalog_credentials_host: the hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog, for cases where the REST catalog uses a different credentials source than cloud storage. (#30284)

Improvements

• max_concurrent_producer_ids and max_transactions_per_coordinator now default to 100,000 and 10,000 respectively (previously unlimited), reducing memory usage from accumulated producer state. Existing explicit overrides are unaffected. (#30058)
• Prevent oversized allocations/OOMs when using a large number of ACLs in Redpanda. (#30967)
• Prevent oversized allocations in the Kafka layer when using large consumer groups. (#30744)
• The schema_registry_cache_schema_count metric now includes a type label (AVRO, JSON, PROTOBUF), replacing the single per-context gauge with one gauge per schema type per context. Dashboards or alerts that query this metric without filtering on type should be updated to sum across the label, e.g. sum by (context) (redpanda_schema_registry_cache_schema_count). (#30725)
• Avoid potential oversized allocations in the segment index materialization path. (#30236)
• Iceberg Topics will stop creating new Parquet files if there is a large backlog of files not yet committed to the Iceberg catalog, and the Iceberg Topics Coordinator now commits to the catalog in chunks — both changes help avoid an OOM when the catalog has rejected Redpanda commits for a prolonged period. (#30958)
• Fixed unnecessary memory allocations/deallocations on the L0 write path in Cloud Topics. (#30980)
• Avoid recompression of unchanged batches in the local storage and Cloud Topics compaction implementation. (#30669)
• Optimize compaction logic, especially for large batches. (#30740)
• Optimize the ACL authorization path for all callers (Kafka handlers, schema registry, Pandaproxy, and Iceberg). (#30829)
• Optimize the segment_meta_cstore::insert_entries() path for the generic append case. (#30601)
• Adds a kafka_fetch_read_coalescing_enabled cluster property. When enabled, partition reads and serialized responses for high fan-out workloads are shared instead of duplicated across responses. (#31010)
• Make the fetch path more resilient to errors in single partitions. (#30097)
• Improve shadowing failover latency on shadow links with large topic counts. (#30089)
• Improves false positive detection in the cloud storage scrubber to filter out compacted reuploads. (#30062)
• Added a new cluster property iceberg_default_schema_case_insensitive (yes / no / auto, default auto) that determines whether the Iceberg subsystem compares field names case-insensitively. auto attempts to detect this automatically for AWS Glue, which addresses a sporadic issue where Glue returns field names lower-cased instead of verbatim. (#30459)
• Purging an Iceberg table managed by the filesystem catalog will now delete all of the table's files, not just the metadata files. (#30691)
• The Iceberg translation state REST endpoint now returns a partition state entry for every partition of the topic and reports the topic's partition_count. (#30576)
• The controller leader is now observable on the public metrics endpoint via the new redpanda_raft_leader_for gauge (1 on the controller leader, 0 otherwise). (#30826)
• Adds the option to configure Schema Registry to use internal RPCs for interacting with the schemas topic, removing the need for explicit authN/Z or ephemeral credentials. (#30046)
• Alters the behavior of restart-required cluster configs so that changes are invisible to Redpanda internals until a node actually restarts; pending changes and restart status still appear in the admin API as before. (#30109)
• Better guard against malformed requests when parsing Kafka messages. (#30191)
• Don't error on potentially unknown cluster properties when issuing removal requests through the admin API. (#30054)
• Downgraded the "attempted to load identical license, doing nothing" admin API log message from info to debug, reducing log noise when operators or automation reapply the same enterprise license on a schedule. (#30188)
• #18422 The internal HTTP client (cloud storage, IAM credential refresh, OIDC, metrics reporter) now tries all DNS-resolved addresses when connecting instead of just one, improving connectivity to dual-stack (IPv4/IPv6) endpoints and failing fast when an endpoint is down. (#30796)
• rpk ai <sub> now reads the active cloud profile's cached AI Gateway URL and only contacts the public API when the cache is empty, removing an extra round trip on every plugin invocation. (#30327)
• rpk debug bundle now samples /proc/interrupts, /proc/softirqs, and /proc/diskstats twice so support can compute counter deltas. (#30279)
• rpk redpanda admin is deprecated and folded into rpk cluster. Use rpk cluster brokers for decommission/recommission, rpk cluster info -b --detailed to list brokers, rpk cluster config list --node-id <ID> to query a broker's view of the cluster config, rpk cluster loggers {list,set} to manage broker log levels, and rpk cluster partitions list --node-ids <ID> to filter partitions by broker. (#30332)
• Redpanda's install setup script now downloads packages from linux.pkg.redpanda.com instead of Cloudsmith. (#30557)
• Decommission may now cancel a stalled cluster node add. (#30377)
• Various internal consensus lifecycle improvements. (#31022)
• Add --format json|yaml|text|help to 20 rpk commands, including cluster maintenance status, cluster config status, profile list, plugin list, and more. (#30194)
• Add Group: principal support to rpk security role assign/unassign, and remove the explicit --group flag to prevent confusion. (#29987)
• rpk: all column headers are now standardized to avoid whitespace, using hyphens instead of underscores. (#30310)
• Updated the default console image version in rpk container commands to v3.8.0. (#30954)

Bug Fixes

• Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). (#30537)
• Upgraded OpenSSL from 3.5.5 to 3.5.6 to address CVE-2026-31790, which could allow an attacker supplying a malformed RSA public key to trigger use of uninitialized memory during RSA key encapsulation. (#30238)
• Upgraded OpenSSL from 3.5.6 to 3.5.7 to resolve 10 CVEs (CVE-2026-45447, CVE-2026-45446, CVE-2026-45445, CVE-2026-42770, CVE-2026-42769, CVE-2026-42766, CVE-2026-42764, CVE-2026-34183, CVE-2026-34182, CVE-2026-34180). (#30797)
• Upgraded libxml2 to v2.15.3 to fix CVE-2026-6732, a type confusion vulnerability in XSD validation. (#30392)
• Upgraded the base container image from Ubuntu Noble to 24.04 to address a Snyk-flagged vulnerability. (#30694)
• Security: prevent the default OpenSSL config from being loaded from the host machine (OPENSSL_CONF env var or /etc/ssl/openssl.cnf) in self-hosted installations, ensuring only Redpanda configs control crypto and TLS settings. (#29763)
• Prevents a potential oversized allocation in Kafka protocol parsing of tagged fields. (#30160)
• Avoid OOM under memory fragmentation when there are many ACLs. (#30368)
• Fixed a cloud topics epoch fencing race where a failed epoch bump could later admit a stale-epoch write, poisoning the partition log and crashing all replicas of the partition. (#31110)
• Fixed a potential broker crash (use-after-free) in the cloud topics metastore when accessing raft state during leadership changes. (#31048)
• Fixed a cluster membership lock that could occur when a node was decommissioned while being added as a controller (raft0) learner. (#30926)
• Fixed a reactor stall in the producer state cache when many producers are unevictable due to in-flight requests or open transactions. (#29991)
• Fixed a rare condition where Tiered Storage metadata spillover could get permanently stuck on partitions with small, frequent segments, leaving orphaned spillover manifest objects in the bucket. (#31081)
• Fixed internal topics being autocreated with incorrect properties. (#31236)
• Fixed compaction incorrectly assigning future timestamps to records compacted from strictly-past input. (#30998)
• #30815 Fixed a raft pre-vote livelock where a follower recovering behind a live leader could repeatedly start elections, leaving partitions under-replicated and stalling acks=all produce with request timeouts. (#30817)
• Fixes a bug in OffsetForLeaderEpoch handling with tiered topics that could cause consumers to reset their fetch position to the beginning of the log held in cloud storage. (#31060)
• Fixes a bug in cloud topics compaction that could cause repeated no-op compactions if the topic uses retention or transactions. (#31122)
• Fixes a bug where Cloud Topics with the compact cleanup policy would have log retention policies applied to them. (#31104)
• Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. (#30303)
• Fixes a crash that could occur in the Cloud Topics metastore upon certain errors during metastore database compaction. (#30730)
• Fixes a hang that could be caused by many concurrent multipart uploads. (#30919)
• Fixes a potential deadlock arising from a race between raft snapshots and transaction operations. (#30207)
• Fixes a rare crash due to a race condition between transaction-related operations and partition shutdown. (#30081)
• Fixes a rare race condition between snapshots and compaction of consumer offset partitions resulting in dangling open transactions. (#30071)
• Fixes a reactor stall seen when there are a large number of pending files in the Iceberg Topics coordinator. (#30868)
• Fixes a wedge in multi-output transforms where a produce failure on one output topic silently stalled the processor instead of restarting it. (#30836)
• Fixes an issue that prevented raft followers across high-RTT links from establishing connections long enough to receive heartbeat request replies. (#30486)
• Fixes an issue where cluster linking would not replicate the partition start offset. (#30996)
• Fix an issue where multi-part delete requests were rejected by ABS when using OAuth (unexpected headers). (#30133)
• Fix an issue where slow replication could cause audit log produce RPCs to pile up effectively unbounded, eventually exhausting memory on the server shard. (#30041)
• Fix an issue with Cloud Topics garbage collection where deleting all cloud topics could leave stale objects in the bucket forever. (#30200)
• Fix consumer group lag metrics inflated after retention or trim-prefix. (#30822)
• Fix consumer group lag metrics reporting 0 for read-replica topics. (#30873)
• Fixed shadow link replication advancing the shadow partition start offset past the source partition's start offset when a replicator resumes after a shadow partition leadership change. (#30785)
• Fixed the vectorized_rpc_client_requests_pending gauge drifting over time. (#30264)
• Fix tiered storage I/O remaining throttled at the previously configured rate after cloud_storage_max_throughput_per_shard was unset. (#30319)
• Fix an assertion crash in the cloud storage self-test when a multipart upload part failed mid-sequence. (#30344)
• Fix a process abort when the tiered storage cache's local disk fills up while a segment download is in progress on a non-zero shard. (#30335)
• Allow combining aws_sigv4 Iceberg REST catalog authentication with the sts cloud credentials source. (#30548)
• Correctly decode variable-length Avro decimal payloads on the ingest path. (#30516)
• Fix Iceberg map columns being unreadable from strict Parquet readers (e.g. Apache Spark) due to a missing LogicalType.MAP annotation in the written Parquet schema. (#30454)
• Fix corruption of negative decimal partition values in Iceberg manifests for decimal columns whose precision does not require 16 bytes (e.g. decimal(10,2)). (#30516)
• Fix parsing of Iceberg table metadata whose sort orders use the spec-canonical singular source-id field (e.g. metadata produced by Unity Catalog). (#30475)
• Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). (#30585)
• Iceberg REST catalog credential refresh requests were being sent to the wrong host when cloud_storage_credentials_host was set; the host override intended for cloud storage was being applied globally. (#30284)
• The day partition transform now produces a date-typed partition column (matching the Iceberg spec) instead of an integer. (#30515)
• Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form (e.g. "string") and object form (e.g. {"type":"string"}). (#30565)
• Fixed schema registry returning a 40403 error when looking up Avro schemas that use unqualified named type references (e.g. "Inner") against registered schemas using fully-qualified references (e.g. "com.example.Inner") within the same namespace. (#30127)
• #30374 Schema Registry: fixed protobuf compatibility checks incorrectly failing with MESSAGE_REMOVED when a map field is removed. (#30400)
• #30398 Fixed a bug in the schema registry where adding a new required field to a JSON schema was incorrectly allowed under BACKWARD compatibility mode. (#30525)
• #30414 Fixed a bug where a double metric registration could occur when STS credentials were used for both Iceberg and Tiered Storage systems. (#30489)
• Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker. (#30701)
• Fixed a spurious storage parser.cc — Stopping parser, short read error that could be logged when a segment was flushed concurrently with an in-flight append (e.g. during raft recovery). (#30660)
• REST proxy and schema registry now return {"error_code": 404, "message": "..."} for unmatched routes, matching the envelope clients already parse. (#30417)
• Metrics that previously ignored disable_public_metrics (raft_learners_gap_bytes, cluster_members_backend_queued_node_operations, cluster_partition_num_with_broken_rack_constraint) now honor it. (#30720)
• Changes to cloud_storage_throughput_limit_percent now take effect at runtime instead of being ignored until restart. (#30230)
• Invalidates LSM iterators when exceptions are thrown. (#30348)
• admin: GET /v1/cluster/health_overview now always includes nodes_in_recovery_mode, even when empty. (#30640)
• report Iceberg-disabled topics as DISABLED in the translation_state response. (#30761)
• rpk/debug/bundle: dedup admin addresses across host forms. (#30403)

---

Full changelog: v26.2.0-dev...v26.2.1

---

This discussion was created from the release v26.2.1.