Daily Dev Stack Release Audit — September 4, 2026: Keycloak Patches Unauthenticated Password-Reset Bypass as Redis and PostgreSQL Ship Security Fixes

Executive summary

A concentrated batch of security patches landed across identity, cache, and database layers over the past few days, alongside a wave of feature releases in the container-orchestration and edge-hosting space. The highlights:

• Keycloak 26.7.2 closes eight CVEs, including CVE-2026-18963, an unauthenticated password-reset bypass that let attackers skip the emailed action token and take over any account — patch immediately if you run a public-facing realm.
• Redis shipped a fresh advisory (CVE-2026-81934) with fixed builds across every supported line, from 8.10.1 down to the 6.2.24 LTS branch.
• PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 closed 28 CVEs and 110+ bugs in one coordinated release — and skipped 18.5 entirely after a regression was caught pre-release.
• Kubernetes v1.37 ("Garhwal") graduated HorizontalPodAutoscaler scale-to-zero to Beta, enabled by default, for queue- and GPU-backed workloads.
• Authentik 2026.8 shipped privileged access management, agent accounts for automation/AI workloads, and is now officially OpenID Certified.
• Prisma ORM pushed v8.0.0-rc.8, retiring the prisma-next binary and renaming .take()/.skip() to .limit()/.offset().
• MongoDB disclosed a driver/server SASL downgrade issue allowing cleartext keyfile disclosure in intra-cluster auth — patched in Server 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2.
• Cloudflare began enforcing D1 daily row-read/write caps on the Workers Free plan and rolled out new SQL-injection threat detection at the edge.

Identity & Authentication

Keycloak 26.7.2

The Keycloak team shipped 26.7.2 on August 19, closing eight CVEs on top of the twelve fixed one release earlier. The standout is CVE-2026-18963, covered in detail by The Hacker News: an unauthenticated attacker could skip the emailed action token during the password-reset flow and take over any account outright. The release also patches CVE-2026-15571, a predictable account-linking hash that enabled account takeover through a malicious OIDC client, plus CVE-2026-45292, CVE-2026-14613, CVE-2026-59888, CVE-2026-59889, CVE-2026-15945, and CVE-2026-17048.

If you're pinning a container tag, bump it now:

# docker-compose.yml
services:
  keycloak:
    image: quay.io/keycloak/keycloak:26.7.2
    command: start --optimized
    environment:
      KC_HOSTNAME: auth.example.com

Authentik 2026.8

Authentik 2026.8 landed September 1 with privileged access management, agent accounts for automation and AI-agent integrations, scheduled user offboarding, custom object attributes, and a large batch of OAuth 2.0 / OIDC improvements — including Dynamic Client Registration, so applications can self-register instead of requiring an admin to hand-create every provider. Authentik is now officially OpenID Certified by the OpenID Foundation for both OP profiles (Basic, Implicit, Hybrid, Config, Form Post) and all three logout profiles.

Databases, Caching & Vector Search

Redis — CVE-2026-81934

Redis published a security advisory for CVE-2026-81934 with fixes across every actively maintained line: Open Source 8.10.1, 8.8.2, 8.6.6, 8.4.6, and 8.2.9, plus long-term branches 7.4.11, 7.2.16, and 6.2.24. Redis Software builds 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303 are also patched. As of August 27, Redis says it has no evidence of active exploitation, but the standing guidance applies: never expose Redis directly to the internet, enforce ACLs at least-privilege, and restrict access to CLIENT KILL, Lua scripting, and Pub/Sub to trusted clients.

PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24

PostgreSQL's coordinated release on August 13 fixed 28 security vulnerabilities and 110+ bugs, alongside PostgreSQL 19 Beta 3. Notably, the 18.x line skipped 18.5 entirely after a regression was caught before ship. Security-relevant fixes include an integer wraparound in 32-bit pltcl/plperl that could undersize an allocation and let a function-body author execute arbitrary code as the OS user running the database; an untrusted search-path issue in amcheck letting a grantee execute arbitrary functions via expression-index owners; and a heap buffer overflow in the regexp engine reachable from query text alone. Mark your calendar: PostgreSQL 14 stops receiving fixes on November 12, 2026 — plan the upgrade now if you're still on it.

MongoDB driver/server advisory

A security advisory flagged an intra-cluster SASL mechanism allow-list gap in egress connection setup that permits a PLAIN-mechanism downgrade and cleartext keyfile disclosure between cluster members, plus a password-masking gap in the Java driver's log output. Patched versions: MongoDB Driver 5.9.2+ and Server 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2.

Containers, Edge & Infrastructure

Kubernetes v1.37 “Garhwal”

Kubernetes 1.37 shipped August 26, and the HPA scale-to-zero feature graduated to Beta — enabled by default — just days later. A HorizontalPodAutoscaler backed by an object or external metric (not CPU/memory, since there's no running pod to sample once you hit zero) can now scale a workload all the way down and bring it back when demand returns. A new ScaledToZero status condition lets the controller distinguish an automated scale-to-zero event from a manually paused deployment. Prime candidates: queue consumers, batch jobs, and GPU-backed inference workloads that sit idle outside business hours.

Docker

Docker Engine's stable line sits at 29.7.2. The bigger story remains CVE-2026-34040 (CVSS 8.8), a fail-open bypass in Docker's AuthZ plugin mechanism: padding a container-creation request past 1MB caused it to be silently dropped before reaching the authorization plugin, undermining any access policy built on top of it. It's fixed as of Engine 29.3.1 — worth a re-read if you run third-party AuthZ plugins and haven't confirmed your fleet is past that version. Docker Model Runner also picked up fixes this cycle for container-to-host code execution in its MLX and vllm-metal inference backends and an SSRF in its OCI Registry Client — all worth checking if you're running local model inference through Docker.

Cloudflare Workers & D1

As of September 1, Cloudflare began enforcing daily row-read/row-write limits on D1 for accounts on the Workers Free plan — queries over the ceiling now fail via both the Workers Binding API and the REST API until the midnight-UTC reset, with email alerts at the threshold. Separately, Cloudflare rolled out new threat detection aimed at SQL-injection attempts that exploit complex query syntax, extending WAF coverage beyond simple payload matching.

Vercel

Vercel's changelog added Gemini 3.8 Flash and Claude Fable 5.1 to AI Gateway (one API key, automatic fallbacks, spend tracking, per-request traces), plus user-scoped budgets so teams can cap what individual members spend through the gateway. On the infra side, AWS PrivateLink is now generally available, letting deployments reach AWS-hosted databases over a private network path instead of the public internet — a meaningful change for teams that couldn't previously put Vercel in front of a VPC-isolated RDS or Aurora cluster.

Meta-Frameworks & Core Web Standards

Next.js

The most recent security-relevant ship was the 16.3.3 / 15.5.24 backport addressing two critical-severity vulnerabilities, alongside routine fixes: app-entry validation scoped correctly to the app/ directory, a catch-all index-routing bug, and Turbopack fixes for worker chunk loading and remote-cache authentication. AVIF image optimization — briefly broken in an earlier 16.3 build — is re-enabled. If you're still evaluating the jump to 16.3, the headline features are Instant Navigations and Partial Prefetching, both aimed at cutting perceived route-change latency. Check the official blog for the full backport list before upgrading a production app.

Astro

Astro landed at 7.2.10 on August 31, a bug-fix release addressing an @astrojs/markdown-remark version-pinning issue, an unreplaced SSR manifest placeholder when the server build is minified, and dev-mode logger initialization order. It follows 7.2's bigger additions — experimental incremental static builds, an opt-out for session support, and a background mode for astro preview. Details on the Astro blog.

Database Tools, ORMs & BaaS

Prisma ORM v8.0.0-rc.8

Prisma's v8 release candidate train is moving fast, and rc.8 shipped alongside @prisma/prisma7, a compatibility package for running Prisma 7 and 8 side by side during migration. Breaking changes accumulated across the RC series are worth reviewing before you touch the migration guide: prisma-next.config.ts and the flat config shape are gone as of rc.4 (only the prisma.config.ts / definePrismaConfig envelope is accepted now); ORM commands moved to unified CLI paths (db migrate, orm init) with standalone aliases retired in rc.5; and collection pagination methods were renamed — .take(n) / .skip(n) are now .limit(n) / .offset(n) as of rc.7. Full history on the Prisma changelog.

// prisma.config.ts (v8 RC)
import { definePrismaConfig } from 'prisma/config'

export default definePrismaConfig({
  schema: './prisma/schema.prisma',
})

Supabase

Supabase confirmed the Management API's logs.all endpoint is being removed on September 23, 2026 — any script still polling it needs to migrate to the new ClickHouse-backed logs endpoint, which only accepts ClickHouse SQL, not the old query shape. Separately, Supabase reported and resolved a project-lifecycle-operations incident earlier this week; error rates and lifecycle operations (pause/resume/delete) were confirmed back to normal as of today. Track both on the Supabase changelog.

Laravel

Laravel 13 formalized its CSRF middleware as PreventRequestForgery, adding origin-aware request verification on top of the existing token-based checks — a defense-in-depth layer against forged cross-origin requests even when a token is somehow replayed. It ships alongside Laravel 13's broader push into first-party AI primitives, JSON:API resource output, and semantic/vector search. Current stable sits at 13.26.1. Full notes in the Laravel release documentation.

Background Jobs, Messaging & Task Queues

BullMQ

BullMQ's Python bindings reached 3.2.1 on September 1, and the core JS/TS package sits at 6.2.0 (August 21) with parallel updates to the Elixir bindings (2.2.0, August 26). No breaking changes in this cycle — mostly parity fixes keeping the language bindings aligned with the core Lua-script engine. Full history on the BullMQ changelog.

What to prioritize today

• If you run public-facing Keycloak: patch to 26.7.2 immediately — CVE-2026-18963 is an unauthenticated account-takeover path.
• If you run Redis anywhere reachable from application servers: confirm you're on a patched build for CVE-2026-81934 and re-check that Redis isn't internet-facing.
• If you're on PostgreSQL 14: start planning your upgrade — fixes stop November 12, 2026.
• If you use Docker AuthZ plugins for access control: verify Engine ≥ 29.3.1 to close CVE-2026-34040.
• If you're mid-migration on Prisma 8 RC: audit for the .take()/.skip() → .limit()/.offset() rename before it bites in CI.