New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.6

v26.4.6​

Built with Go 1.27.3 to fix CVE-2026-111943​

Ory Kratos Identities, Ory Hydra Authorization, Ory Keto Permissions, Ory Oathkeeper IAM Proxy, and Ory Talos Secure API Keys are now built with Go 1.27.3. This Go release fixes CVE-2026-111943 in the Go standard library.

Certificate verification now rejects certificates issued through a known set of compromised intermediate certificate authorities, even if the system trust store still contains them. This covers every TLS connection the services verify, such as webhooks, OpenID Connect discovery, and databases. A connection to a server that presents such a certificate now fails. Replace those certificates with ones from a trusted issuer.