Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper v26.4.6 released

Ory Hydra

Built with Go 1.27.3 to fix CVE-2026-111943

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Kratos

UAE PASS sign-in uses UUID

Ory uses the UUID returned by UAE PASS to identify linked accounts on subsequent sign-ins. Jsonnet now receives the UUID as claims.sub; the upstream sub remains available as claims.raw_claims.sub.

Breaking changes

UAE PASS must return a non-empty UUID for registration, account linking, and sign-in. Existing connections keyed by the upstream sub require migration or relinking before this change is enabled.

Built with Go 1.27.3 to fix CVE-2026-111943

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.

Throttle failed sign-in attempts per identifier and IP

When enabled, Ory Identities slows down repeated failed sign-in attempts per submitted identifier and per client IP, with a delay that doubles after each further failure. There is no account lockout, because every delay is capped at a configured maximum. Configure it under selfservice.flows.login.brute_force_protection.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Keto

Built with Go 1.27.3 to fix CVE-2026-111943

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Oathkeeper

Built with Go 1.27.3 to fix CVE-2026-111943

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.

This is now available for the Ory Enterprise License and will be part of the next Ory Open Source release.

Ory Network, Ory Polis, Ory Elements, and Ory Terraform

No significant changes in this release.