What changed in Redpanda from 25 to 26

Features

• rpk sql debug bundle collects a diagnostic bundle from an Oxla (SQL) cluster. by @Bixkog in #31078 by @tyson-redpanda in #31294
• rpk generate grafana-dashboard gains a new operations-stretch dashboard: a Grafana dashboard for stretch clusters managed by the Redpanda Operator, covering cross-cluster raft health, StretchCluster member status, and operator reconcile health. Generate it with rpk generate grafana-dashboard --dashboard operations-stretch. by @RafalKorepta in #31641
• rpk generate grafana-dashboard now offers a load-factor dashboard showing utilization relative to capacity for key broker resources (CPU, IO scheduler, disk IOPS, memory, network bandwidth, client connections). by @travisdowns in #31555
• rpk now supports Shadow Link role sync in Redpanda Cloud clusters by @r-vasquez in #31625
• rpk shadow update now accepts a --config-file flag to apply a configuration file directly. by @r-vasquez in #31329

Bug Fixes

• Fix the registered config name for leader_balancer_node_mute_timeout. by @WillemKauf in #31359
• Fixed Schema Registry aborting the broker when a request failed before its deferred authorization check with schema_registry_enable_authorization enabled. Such requests now return an error response. by @nguyen-andrew in #31590
• Fixed a crash that could occur when removing a partition with a very large number of log segments, e.g. during partition rebalancing. by @pgellert in #31503
• Fixed a crash where a snapshot write failing on a full disk (ENOSPC) aborted the node with a misleading "snapshot writer has to be closed" assertion instead of surfacing the I/O error. by @nvartolomei in #31277
• Fixed a crash where a snapshot write failing on a full disk (ENOSPC) aborted the node with a misleading "snapshot writer has to be closed" assertion instead of surfacing the I/O error. by @nvartolomei in #31180 by @tyson-redpanda in #31294
• Fixed a race in the internal Kafka client where a concurrent request on a freshly established SASL connection could be sent before authentication finished, causing the broker to drop the connection. by @nvartolomei in #31273
• Fixed a race in the internal Kafka client where a concurrent request on a freshly established SASL connection could be sent before authentication finished, causing the broker to drop the connection. by @nvartolomei in #31152 by @tyson-redpanda in #31294
• Fixes a bug in timequeries on cloud topics which could result in returning an offset up to one indexing interval (4_MiB of records by default) later than the first record at or after the requested timestamp by @WillemKauf in #31417
• Fixes a bug in which L0 batches in a cloud topic forgot to preserve last_offset_delta in their header, leading to an under-declared last offset which can stall consumers, skip records, or halt exact-offset replication. by @WillemKauf in #31364
• Fixes a bug in which timequeries on a cloud topic could either fail by dropping the client connection or by returning an unfetchable offset below a partition's start offset. by @WillemKauf in #31424
• Fixes a bug in which topics with min.compaction.lag.ms left unconfigured with produced batches holding timestamps in the future would be considered ineligible for compaction by @WillemKauf in #31458
• Fixes a bug in which transient TOPIC_AUTHORIZATION_FAILED errors and SASL authentication failures were possible during application of a controller snapshot. by @WillemKauf in #31435
• Fixes a bug where corrupted storage would not yield a bad CRC in returned record batches. by @andrwng in #31389
• Fixes a bug where having a cloud topic read replica on a given cluster would prevent L0 objects on that cluster from being garbage collected. by @andrwng in #31390
• Fixes a potential crash in `DescribeLogDirs` by @WillemKauf in #31173 by @tyson-redpanda in #31294
• Fixes an issue where backpressure from the Iceberg coordinator would cause high CPU load on the translators. by @andrwng in #31583
• Fixes potential unbounded growth of various s3_fifo users under specific workloads. by @ballard26 in #31643
• HTTP Proxy: Consumer group fetches no longer fail indefinitely with `offset_out_of_range` after retention moves a topic's log start offset past 0; the consumer now recovers to the earliest available offset (`auto.offset.reset=earliest`). by @bartoszpiekny-redpanda in #31064 by @tyson-redpanda in #31294
• Lifecycle fix on groups by @joe-redpanda in #31171 by @tyson-redpanda in #31294
• Redpanda will no longer incorrectly accept client-produced control batches. by @andrwng in #31605
• Updating a Shadow Link that uses PLAIN authentication no longer fails when the password is omitted; the stored password is preserved. by @r-vasquez in #31394
• #31446 rpk connect install --connect-version no longer rejects versions with a segment of three or more digits, which had blocked pinning any Redpanda Connect release since 4.100.0. Malformed versions with trailing characters are now rejected during validation rather than failing at download. by @prakhargarg105 in #31447
• #31548 rpk connect upgrade no longer fails to determine the currently-installed Redpanda Connect version when that version has a segment of three or more digits, which had blocked upgrading any Connect install since 4.100.0. by @JakeSCahill in #31549
• rpk security secrets list no longer truncates its output at 100 secrets. by @simon0191 in #31434
• rpk shadow create no longer fails secret-reference validation on clusters with more than one page of REDPANDA_CLUSTER-scoped secrets. by @simon0191 in #31434
• rpk shadow update in editor mode now replaces the entire Shadow Link configuration instead of merging changed fields, so list-valued fields (e.g. topic filters) can shrink or be cleared. by @r-vasquez in #31394
• The describe-storage RPK command will now have a valid output for tiered_v2 topics by @andrwng in #31267
• Avoids a reactor stall on the Iceberg coordinator snapshotting mechanism when there is a large number of parquet files pending commit by @nvartolomei in #31278
• Fixes a rare crash in Cloud Topics caused by replication failures. by @Lazin in #31523
• Fixed a use-after-free during shutdown in the Kafka quota manager's garbage collection. by @nvartolomei

Improvements

• Cloud Topics compaction will now commit work in chunks, which should result in more stable compaction for partitions with a large amount of data. by @WillemKauf in #31312
• Added a `schema_registry_replay_on_startup` cluster property (default off) that hydrates the Schema Registry store at broker start-up rather than lazily on the first request. by @sjust-redpanda in #31137 by @tyson-redpanda in #31294
• Avoid oversized allocations for some of the `schema_registry` and `pandaproxy` handler interfaces. by @WillemKauf in #31103 by @tyson-redpanda in #31294
• Fixes an issue where /v1/usage responses could cause oversized allocations for clusters with a large number of Iceberg-enabled topics. by @WillemKauf in #31333
• HTTP Proxy: a consumer group now resumes from its committed offset on a fresh consumer instance instead of re-reading from the earliest available offset. by @bartoszpiekny-redpanda in #31112 by @tyson-redpanda in #31294
• Optimize the `schema_registry` recovery path by caching references when canonicalizing schemas. by @WillemKauf in #31141 by @tyson-redpanda in #31294
• Optimize the cloud topics and local storage compaction implementations by reducing the amount of record copying performed. by @WillemKauf in #31018 by @tyson-redpanda in #31294
• Schema Registry now logs whether a 403 on GET /schemas/ids/{id} was caused by a schema id that does not exist or by missing ACLs. The response returned to clients is unchanged. by @nguyen-andrew in #31590
• Schema Registry now replays the internal `_schemas` topic exactly once when recovering on startup, instead of running redundant concurrent replays; cold start of a large registry is significantly faster. by @sjust-redpanda in #31137 by @tyson-redpanda in #31294
• The key-value store now terminates the process on unrecoverable I/O errors in its flush path instead of silently stalling writes. by @nvartolomei in #31463
• Updated default console image version in rpk container commands to v3.9.0 by @vbotbuildovich in #31330
• When producing or consuming with Schema Registry, `rpk topic produce` and `rpk topic consume` now read the topic's `redpanda.schema.registry.context` with a `DescribeConfigs` request (unless `--schema-context` is given). by @sjust-redpanda in #31089 by @tyson-redpanda in #31294
• #31303 rpk topic alter-config now supports a --regex/-r flag to alter the config of all topics matching one or more regular expressions. by @telegraphchi in #31304
• `rpk topic produce` and `rpk topic consume` now resolve Schema Registry schemas in the context bound to the topic via `redpanda.schema.registry.context`, and add a `--schema-context` flag to select the context explicitly. by @sjust-redpanda in #31089 by @tyson-redpanda in #31294
• rpk cluster health will now display any nodes that may be in maintenance mode. by @alextreichler in #31350

Partial Changelog: https://github.com/redpanda-data/redpanda/compare/v26.2.1...fd30e45b31e0c5e9595e530121a0896e3ddd12a3

Bug Fixes

• Fixed an issue where audit-log initialization unconditionally sent a CreateTopics request to the controller leader, causing authentication and the admin API to be rejected cluster-wide (with audit_failure_policy=reject) for the duration of any prolonged leaderless state. Initialization now checks the local topic table first and skips the CreateTopics call when the audit topic already exists. by @andresaristizabal-rp in #31411
• Fixed an issue where backpressure from the Iceberg coordinator caused high CPU load on the Datalake translators. The translation loop was treating a backpressured fetch as a successful iteration and cancelling its retry jitter, causing it to spin as fast as the RPC completed rather than applying the normal jittered sleep. by @pgellert in #31419
• Reverted the c-ares DNS resolver from 1.34.7 back to 1.34.6. c-ares 1.34.7 contains an upstream regression (c-ares/c-ares#1256) where a DNS query completion callback can silently never be invoked, which could leave an internal broker-to-broker RPC connection permanently unable to reconnect after a peer broker restart. Affected clusters showed persistently under-replicated partitions and failing broker readiness probes. Reverting c-ares reintroduces CVE-2026-33630; the CVE fix will be re-applied once upstream resolves the regression. by @bartoszpiekny-redpanda in #31634

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.16...v26.1.17

IMPORTANT: Do not install the 26.1.16 release. A critical bug was identified that has broad implications that can create instability for long-running clusters. This issue is fixed in 26.1.17. Please upgrade directly to 26.1.17 or 26.2.x

Bug Fixes

• Fixed a crash that could occur when removing a partition with a very large number of log segments, e.g. during partition rebalancing. by @pgellert in #31505
• Fixed a crash where a snapshot write failing on a full disk (ENOSPC) aborted the node with a misleading "snapshot writer has to be closed" assertion instead of surfacing the I/O error. by @nvartolomei in #31186
• Fixed a double-free / use-after-free in c-ares query-completion handling (CVE-2026-33630). by @bartoszpiekny-redpanda in #31486
• Fixed a race in the internal Kafka client where a concurrent request on a freshly established SASL connection could be sent before authentication finished, causing the broker to drop the connection. by @nvartolomei in #31192
• #31550 rpk connect upgrade no longer fails to determine the currently-installed Redpanda Connect version when that version has a segment of three or more digits, which had blocked upgrading any Connect install since 4.100.0. by @JakeSCahill in #31551

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.15...v26.1.16

Bug Fixes

• Fix the registered config name for leader_balancer_node_mute_timeout. by @WillemKauf in #31360
• Fixes a bug in which L0 batches in a cloud topic forgot to preserve last_offset_delta in their header, leading to an under-declared last offset which can stall consumers, skip records, or halt exact-offset replication. by @WillemKauf in #31363
• Fixes a bug in which topics with min.compaction.lag.ms left unconfigured with produced batches holding timestamps in the future would be considered ineligible for compaction by @WillemKauf in #31459
• Fixes a bug in which transient TOPIC_AUTHORIZATION_FAILED errors and SASL authentication failures were possible during application of a controller snapshot. by @WillemKauf in #31437
• Fixes a bug where corrupted storage would not yield a bad CRC in returned record batches. by @andrwng in #31388
• Fixes a bug where having a cloud topic read replica on a given cluster would prevent L0 objects on that cluster from being garbage collected. by @andrwng in #31391
• Updating a Shadow Link that uses PLAIN authentication no longer fails when the password is omitted; the stored password is preserved. by @r-vasquez in #31421
• #31448 rpk connect install --connect-version no longer rejects versions with a segment of three or more digits, which had blocked pinning any Redpanda Connect release since 4.100.0. Malformed versions with trailing characters are now rejected during validation rather than failing at download. by @prakhargarg105 in #31449
• rpk security secrets list no longer truncates its output at 100 secrets. by @simon0191 in #31436
• rpk shadow create no longer fails secret-reference validation on clusters with more than one page of REDPANDA_CLUSTER-scoped secrets. by @simon0191 in #31436
• rpk shadow update in editor mode now replaces the entire Shadow Link configuration instead of merging changed fields, so list-valued fields (e.g. topic filters) can shrink or be cleared. by @r-vasquez in #31421

Improvements

• #31335 Fixes an issue where /v1/usage responses could cause oversized allocations for clusters with a large number of Iceberg-enabled topics. by @WillemKauf in #31337
• rpk cluster health will now display any nodes that may be in maintenance mode. by @alextreichler in #31352

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.14...v26.1.15

Redpanda v26.2 Release Notes

Features

• Redpanda Enterprise (excludes Redpanda BYOC/Dedicated/Serverless) now supports major version rollback via ‘unfinalized’ upgrades. rpk cluster upgrade finalize and rpk cluster upgrade status manage deferred (unfinalized) major-version upgrades. (#30930)
• Shadowing from non-Redpanda Schema Registries using the HTTP Schema Registry API. rpk shadow provides support for the new Schema Registry Sync option shadow_schema_registry_api in Shadow Links. (#30860)
• Schema Registry sync shadow links now enforce the link's max_source_requests_per_second setting (default 30 requests/sec) when reading from the source registry, and honor a throttling source's Retry-After response header. (#31101)
• Schema Registry shadowing now exports its sync totals as shadow_link_schema_registry_* counters on the internal and public metrics endpoints, labelled by shadow_link_name. (#31067)
• Shadow links can now mirror RBAC roles from the source cluster to the destination. Configure role sync on the link with a sync interval and role-name filters to select which roles are kept in sync. (#30946)
• rpk now supports role_sync_options when creating a Shadow Link. (#30909)
• Shadowing now supports Cloud Topics. (#30073)
• Tiered Storage V2 beta. A new default_redpanda_storage_mode_tiered_impl cluster config (tiered_v1 | tiered_v2, default tiered_v1) selects whether the tiered value of the redpanda.storage.mode topic property refers to classic Tiered Storage or the new version of tiered storage. Tiered Storage v2 is a beta feature in v26.2. (#30966)
• New read-only redpanda.storage.mode.impl topic property reports the exact implementation of every topic's storage mode (unset|local|tiered_v1|tiered_v2|cloud), and can be supplied on topic creation to select the storage mode precisely. Topics using the tiered_v2 implementation (beta) can only be created once the whole cluster runs v26.2. (#30966)
• Schema Registry context support is now enabled by default. Subjects of the form :.context:subject are parsed into a separate context. See the upgrade considerations before upgrading clusters that may have stored literal :.-prefixed subject names. (#30365)
• Schema Registry now accepts /contexts/{context}/... prefixed URLs on all endpoints, allowing serde clients to target a non-default context by configuring their base URL (e.g. schema.registry.url=http://host:8081/contexts/.myctx). (#30189)
• Add OAUTHBEARER SASL mechanism support to rpk, enabling OIDC-based authentication for the Kafka client, admin API, and schema registry. Pass the token via --password (raw value or token:<TOKEN> format) with --sasl-mechanism OAUTHBEARER. (#30169)
• #30222 Add OAUTHBEARER SASL mechanism support to the admin API endpoint used by rpk debug remote-bundle start, enabling remote debug bundle collection against clusters configured with OAUTHBEARER authentication. (#30225)
• rpk debug remote-bundle start now supports OAUTHBEARER (OIDC) profiles. Pass the bearer token via --password (or kafka_api.sasl.password in the rpk profile) when sasl.mechanism is OAUTHBEARER. (#30277)
• Adds a new layout key to the Iceberg translation mode as a config string, in the value section. layout supports nested and flat; flat is the default and matches previous behavior. (#30917)
• Iceberg translation now supports schema registry contexts. Configure a topic to resolve schemas in a context via the redpanda.schema.registry.context topic property. (#30132)
• Added per-entity Kafka quota metrics. Set kafka_per_entity_quota_metrics to true (default false, no restart) to expose per-entity throttling and throughput counters for produce, fetch, and partition-mutation quotas. (#30832)
• Add rpk check as a new managed plugin for production readiness validation. It checks cluster health, broker configuration, security settings, replication factors, licensing, TLS, and Kubernetes resource configuration against the official production readiness checklists. Supports auto-install, upgrade, and uninstall via rpk check install, rpk check upgrade, and rpk check uninstall. (#30146)
• Add rpk k8s, a new managed plugin for interacting with Redpanda clusters running on Kubernetes. On first use, rpk auto-downloads, checksum-verifies, and caches the plugin; manage it explicitly with rpk k8s install / upgrade / uninstall. (#30833)
• Added an admin API endpoint to cancel an in-progress controller (raft0) reconfiguration. (#30918)
• Added redpanda_cluster_health_* Prometheus metrics (public and internal endpoints) exposing the same inputs as rpk cluster health, including nodes_down, leaderless_partitions, under_replicated_partitions, unhealthy_reasons, and a metadata_age_seconds freshness gauge. Disabled by default; enable with the new health_monitor_metrics_enabled cluster property. (#30769)
• Expose estimated cloud instance hardware capacity (vCPUs, memory, disk, network bandwidth, and IOPS) as Prometheus metrics, derived from the detected cloud instance type. (#30742)
• rpk --print-tree emits the full rpk command tree as a single JSON document, suited for LLMs and automation. (#30380)
• rpk redpanda admin broker list now includes a --detailed flag with additional per-path disk usage information, and supports the --format json/yaml flag. (#30096)
• Added rpk cloud auth token to print the current cloud auth token. (#29964)
• New metric vectorized_kafka_leadership_changes counts leadership changes in a topic. (#30117)
• New cluster config oidc_http_proxy_url routes OIDC discovery and JWKS fetches through an HTTP forward proxy. Set to a URL of the form http://host:port or https://host:port to enable; leave unset (the default) to connect to the OIDC endpoint directly. Live-reloadable, no broker restart required. (#30268)
• New cluster configs oidc_http_proxy_username / oidc_http_proxy_password add HTTP Basic authentication to the OIDC forward proxy; (#30738)
• New configuration iceberg_rest_catalog_credentials_host: the hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog, for cases where the REST catalog uses a different credentials source than cloud storage. (#30284)

Improvements

• max_concurrent_producer_ids and max_transactions_per_coordinator now default to 100,000 and 10,000 respectively (previously unlimited), reducing memory usage from accumulated producer state. Existing explicit overrides are unaffected. (#30058)
• Prevent oversized allocations/OOMs when using a large number of ACLs in Redpanda. (#30967)
• Prevent oversized allocations in the Kafka layer when using large consumer groups. (#30744)
• The schema_registry_cache_schema_count metric now includes a type label (AVRO, JSON, PROTOBUF), replacing the single per-context gauge with one gauge per schema type per context. Dashboards or alerts that query this metric without filtering on type should be updated to sum across the label, e.g. sum by (context) (redpanda_schema_registry_cache_schema_count). (#30725)
• Avoid potential oversized allocations in the segment index materialization path. (#30236)
• Iceberg Topics will stop creating new Parquet files if there is a large backlog of files not yet committed to the Iceberg catalog, and the Iceberg Topics Coordinator now commits to the catalog in chunks — both changes help avoid an OOM when the catalog has rejected Redpanda commits for a prolonged period. (#30958)
• Fixed unnecessary memory allocations/deallocations on the L0 write path in Cloud Topics. (#30980)
• Avoid recompression of unchanged batches in the local storage and Cloud Topics compaction implementation. (#30669)
• Optimize compaction logic, especially for large batches. (#30740)
• Optimize the ACL authorization path for all callers (Kafka handlers, schema registry, Pandaproxy, and Iceberg). (#30829)
• Optimize the segment_meta_cstore::insert_entries() path for the generic append case. (#30601)
• Adds a kafka_fetch_read_coalescing_enabled cluster property. When enabled, partition reads and serialized responses for high fan-out workloads are shared instead of duplicated across responses. (#31010)
• Make the fetch path more resilient to errors in single partitions. (#30097)
• Improve shadowing failover latency on shadow links with large topic counts. (#30089)
• Improves false positive detection in the cloud storage scrubber to filter out compacted reuploads. (#30062)
• Added a new cluster property iceberg_default_schema_case_insensitive (yes / no / auto, default auto) that determines whether the Iceberg subsystem compares field names case-insensitively. auto attempts to detect this automatically for AWS Glue, which addresses a sporadic issue where Glue returns field names lower-cased instead of verbatim. (#30459)
• Purging an Iceberg table managed by the filesystem catalog will now delete all of the table's files, not just the metadata files. (#30691)
• The Iceberg translation state REST endpoint now returns a partition state entry for every partition of the topic and reports the topic's partition_count. (#30576)
• The controller leader is now observable on the public metrics endpoint via the new redpanda_raft_leader_for gauge (1 on the controller leader, 0 otherwise). (#30826)
• Adds the option to configure Schema Registry to use internal RPCs for interacting with the schemas topic, removing the need for explicit authN/Z or ephemeral credentials. (#30046)
• Alters the behavior of restart-required cluster configs so that changes are invisible to Redpanda internals until a node actually restarts; pending changes and restart status still appear in the admin API as before. (#30109)
• Better guard against malformed requests when parsing Kafka messages. (#30191)
• Don't error on potentially unknown cluster properties when issuing removal requests through the admin API. (#30054)
• Downgraded the "attempted to load identical license, doing nothing" admin API log message from info to debug, reducing log noise when operators or automation reapply the same enterprise license on a schedule. (#30188)
• #18422 The internal HTTP client (cloud storage, IAM credential refresh, OIDC, metrics reporter) now tries all DNS-resolved addresses when connecting instead of just one, improving connectivity to dual-stack (IPv4/IPv6) endpoints and failing fast when an endpoint is down. (#30796)
• rpk ai <sub> now reads the active cloud profile's cached AI Gateway URL and only contacts the public API when the cache is empty, removing an extra round trip on every plugin invocation. (#30327)
• rpk debug bundle now samples /proc/interrupts, /proc/softirqs, and /proc/diskstats twice so support can compute counter deltas. (#30279)
• rpk redpanda admin is deprecated and folded into rpk cluster. Use rpk cluster brokers for decommission/recommission, rpk cluster info -b --detailed to list brokers, rpk cluster config list --node-id <ID> to query a broker's view of the cluster config, rpk cluster loggers {list,set} to manage broker log levels, and rpk cluster partitions list --node-ids <ID> to filter partitions by broker. (#30332)
• Redpanda's install setup script now downloads packages from linux.pkg.redpanda.com instead of Cloudsmith. (#30557)
• Decommission may now cancel a stalled cluster node add. (#30377)
• Various internal consensus lifecycle improvements. (#31022)
• Add --format json|yaml|text|help to 20 rpk commands, including cluster maintenance status, cluster config status, profile list, plugin list, and more. (#30194)
• Add Group: principal support to rpk security role assign/unassign, and remove the explicit --group flag to prevent confusion. (#29987)
• rpk: all column headers are now standardized to avoid whitespace, using hyphens instead of underscores. (#30310)
• Updated the default console image version in rpk container commands to v3.8.0. (#30954)

Bug Fixes

• Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). (#30537)
• Upgraded OpenSSL from 3.5.5 to 3.5.6 to address CVE-2026-31790, which could allow an attacker supplying a malformed RSA public key to trigger use of uninitialized memory during RSA key encapsulation. (#30238)
• Upgraded OpenSSL from 3.5.6 to 3.5.7 to resolve 10 CVEs (CVE-2026-45447, CVE-2026-45446, CVE-2026-45445, CVE-2026-42770, CVE-2026-42769, CVE-2026-42766, CVE-2026-42764, CVE-2026-34183, CVE-2026-34182, CVE-2026-34180). (#30797)
• Upgraded libxml2 to v2.15.3 to fix CVE-2026-6732, a type confusion vulnerability in XSD validation. (#30392)
• Upgraded the base container image from Ubuntu Noble to 24.04 to address a Snyk-flagged vulnerability. (#30694)
• Security: prevent the default OpenSSL config from being loaded from the host machine (OPENSSL_CONF env var or /etc/ssl/openssl.cnf) in self-hosted installations, ensuring only Redpanda configs control crypto and TLS settings. (#29763)
• Prevents a potential oversized allocation in Kafka protocol parsing of tagged fields. (#30160)
• Avoid OOM under memory fragmentation when there are many ACLs. (#30368)
• Fixed a cloud topics epoch fencing race where a failed epoch bump could later admit a stale-epoch write, poisoning the partition log and crashing all replicas of the partition. (#31110)
• Fixed a potential broker crash (use-after-free) in the cloud topics metastore when accessing raft state during leadership changes. (#31048)
• Fixed a cluster membership lock that could occur when a node was decommissioned while being added as a controller (raft0) learner. (#30926)
• Fixed a reactor stall in the producer state cache when many producers are unevictable due to in-flight requests or open transactions. (#29991)
• Fixed a rare condition where Tiered Storage metadata spillover could get permanently stuck on partitions with small, frequent segments, leaving orphaned spillover manifest objects in the bucket. (#31081)
• Fixed internal topics being autocreated with incorrect properties. (#31236)
• Fixed compaction incorrectly assigning future timestamps to records compacted from strictly-past input. (#30998)
• #30815 Fixed a raft pre-vote livelock where a follower recovering behind a live leader could repeatedly start elections, leaving partitions under-replicated and stalling acks=all produce with request timeouts. (#30817)
• Fixes a bug in OffsetForLeaderEpoch handling with tiered topics that could cause consumers to reset their fetch position to the beginning of the log held in cloud storage. (#31060)
• Fixes a bug in cloud topics compaction that could cause repeated no-op compactions if the topic uses retention or transactions. (#31122)
• Fixes a bug where Cloud Topics with the compact cleanup policy would have log retention policies applied to them. (#31104)
• Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. (#30303)
• Fixes a crash that could occur in the Cloud Topics metastore upon certain errors during metastore database compaction. (#30730)
• Fixes a hang that could be caused by many concurrent multipart uploads. (#30919)
• Fixes a potential deadlock arising from a race between raft snapshots and transaction operations. (#30207)
• Fixes a rare crash due to a race condition between transaction-related operations and partition shutdown. (#30081)
• Fixes a rare race condition between snapshots and compaction of consumer offset partitions resulting in dangling open transactions. (#30071)
• Fixes a reactor stall seen when there are a large number of pending files in the Iceberg Topics coordinator. (#30868)
• Fixes a wedge in multi-output transforms where a produce failure on one output topic silently stalled the processor instead of restarting it. (#30836)
• Fixes an issue that prevented raft followers across high-RTT links from establishing connections long enough to receive heartbeat request replies. (#30486)
• Fixes an issue where cluster linking would not replicate the partition start offset. (#30996)
• Fix an issue where multi-part delete requests were rejected by ABS when using OAuth (unexpected headers). (#30133)
• Fix an issue where slow replication could cause audit log produce RPCs to pile up effectively unbounded, eventually exhausting memory on the server shard. (#30041)
• Fix an issue with Cloud Topics garbage collection where deleting all cloud topics could leave stale objects in the bucket forever. (#30200)
• Fix consumer group lag metrics inflated after retention or trim-prefix. (#30822)
• Fix consumer group lag metrics reporting 0 for read-replica topics. (#30873)
• Fixed shadow link replication advancing the shadow partition start offset past the source partition's start offset when a replicator resumes after a shadow partition leadership change. (#30785)
• Fixed the vectorized_rpc_client_requests_pending gauge drifting over time. (#30264)
• Fix tiered storage I/O remaining throttled at the previously configured rate after cloud_storage_max_throughput_per_shard was unset. (#30319)
• Fix an assertion crash in the cloud storage self-test when a multipart upload part failed mid-sequence. (#30344)
• Fix a process abort when the tiered storage cache's local disk fills up while a segment download is in progress on a non-zero shard. (#30335)
• Allow combining aws_sigv4 Iceberg REST catalog authentication with the sts cloud credentials source. (#30548)
• Correctly decode variable-length Avro decimal payloads on the ingest path. (#30516)
• Fix Iceberg map columns being unreadable from strict Parquet readers (e.g. Apache Spark) due to a missing LogicalType.MAP annotation in the written Parquet schema. (#30454)
• Fix corruption of negative decimal partition values in Iceberg manifests for decimal columns whose precision does not require 16 bytes (e.g. decimal(10,2)). (#30516)
• Fix parsing of Iceberg table metadata whose sort orders use the spec-canonical singular source-id field (e.g. metadata produced by Unity Catalog). (#30475)
• Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). (#30585)
• Iceberg REST catalog credential refresh requests were being sent to the wrong host when cloud_storage_credentials_host was set; the host override intended for cloud storage was being applied globally. (#30284)
• The day partition transform now produces a date-typed partition column (matching the Iceberg spec) instead of an integer. (#30515)
• Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form (e.g. "string") and object form (e.g. {"type":"string"}). (#30565)
• Fixed schema registry returning a 40403 error when looking up Avro schemas that use unqualified named type references (e.g. "Inner") against registered schemas using fully-qualified references (e.g. "com.example.Inner") within the same namespace. (#30127)
• #30374 Schema Registry: fixed protobuf compatibility checks incorrectly failing with MESSAGE_REMOVED when a map field is removed. (#30400)
• #30398 Fixed a bug in the schema registry where adding a new required field to a JSON schema was incorrectly allowed under BACKWARD compatibility mode. (#30525)
• #30414 Fixed a bug where a double metric registration could occur when STS credentials were used for both Iceberg and Tiered Storage systems. (#30489)
• Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker. (#30701)
• Fixed a spurious storage parser.cc — Stopping parser, short read error that could be logged when a segment was flushed concurrently with an in-flight append (e.g. during raft recovery). (#30660)
• REST proxy and schema registry now return {"error_code": 404, "message": "..."} for unmatched routes, matching the envelope clients already parse. (#30417)
• Metrics that previously ignored disable_public_metrics (raft_learners_gap_bytes, cluster_members_backend_queued_node_operations, cluster_partition_num_with_broken_rack_constraint) now honor it. (#30720)
• Changes to cloud_storage_throughput_limit_percent now take effect at runtime instead of being ignored until restart. (#30230)
• Invalidates LSM iterators when exceptions are thrown. (#30348)
• admin: GET /v1/cluster/health_overview now always includes nodes_in_recovery_mode, even when empty. (#30640)
• report Iceberg-disabled topics as DISABLED in the translation_state response. (#30761)
• rpk/debug/bundle: dedup admin addresses across host forms. (#30403)

---

Full changelog: https://github.com/redpanda-data/redpanda/compare/v26.2.0-dev...v26.2.1

Bug Fixes

• Fixed a cloud-topics epoch fencing race where an epoch bump whose replication failed could later admit a stale-epoch write, poisoning the partition log and crashing all replicas of the partition. by @Lazin in #31140
• Fixes a bug in OffsetForLeaderEpoch handling with tiered topics which could cause consumers to reset their fetch position to the beginning of the log held in cloud storage. by @WillemKauf in #31074
• Fixes a potential crash in DescribeLogDirs by @WillemKauf in #31196
• HTTP Proxy: Consumer group fetches no longer fail indefinitely with offset_out_of_range after retention moves a topic's log start offset past 0; the consumer now recovers to the earliest available offset (auto.offset.reset=earliest). by @bartoszpiekny-redpanda in #31207
• Lifecycle fix on groups by @joe-redpanda in #31182
• #30885 Fixed a raft pre-vote livelock where a follower recovering behind a live leader could repeatedly start elections, leaving partitions under-replicated and stalling acks=all produce with request timeouts. by @stevenpall in #30886
• #31238 Fixes a bug in which internal topics could be auto-created with the wrong topic properties by @WillemKauf in #31239
• fix allocation double free on no-op rf changes by @joe-redpanda in #31116

Improvements

• Added a `schema_registry_replay_on_startup` cluster property (default off) that hydrates the Schema Registry store at broker start-up rather than lazily on the first request. by @sjust-redpanda in #31174
• Avoid oversized allocations for some of the `schema_registry` and `pandaproxy` handler interfaces. by @WillemKauf in #31200
• HTTP Proxy: a consumer group now resumes from its committed offset on a fresh consumer instance instead of re-reading from the earliest available offset. by @bartoszpiekny-redpanda in #31225
• Optimize the `schema_registry` recovery path by caching references when canonicalizing schemas by @WillemKauf in #31193
• Schema Registry now replays the internal `_schemas` topic exactly once when recovering on startup, instead of running redundant concurrent replays; cold start of a large registry is significantly faster. by @sjust-redpanda in #31174

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.13...v26.1.14

Bug Fixes

• Fix consumer group lag metrics reporting 0 for read-replica topics. by @bartoszpiekny-redpanda in #30939
• Fixed a cluster membership lock that could occur when a node was decommissioned while it was being added as a controller (raft0) learner. by @mmaslankaprv in #31091
• Fixed a potential broker crash (use-after-free) in the cloud topics metastore when accessing Raft state during leadership changes. by @nvartolomei in #31052
• Fixes a bug in cloud topics compaction that could cause repeated no-op compactions if the topic uses retention or transactions. by @andrwng in #31124
• Fixes a bug where Cloud Topics with the compact cleanup policy would have log retention policies applied to them. by @andrwng in #31111
• Fixes an issue where cluster linking would not replicate the partition start offset. by @andrwng in #31000
• rpk ai no longer requires a selected Redpanda Cloud cluster to run. The AI CLI uses its own rpk ai auth login and rpk ai env use, independent of any rpk cloud session. by @birdayz in #31079
• fix a latent double get_exception call on a failed future in cloud topics metastore by @oleiman in #31045

Improvements

• Adds a new enable_development_metrics cluster configuration (false by default, runtime configurable). When enabled, internal_rpc_latency metrics are exposed to the internal /metrics endpoint. This family of metrics can be expensive (large number of series) - leave it set to false to save on metrics scraping costs. by @WillemKauf in #30957
• Fixes a bug where unnecessary memory allocations/deallocations were being made on the L0 write path in cloud topics by @WillemKauf in #30983
• Iceberg Topics will stop creating new parquet files if there is a large backlog of files not yet committed to the Iceberg catalog. This helps avoid an OOM when the catalog has rejected Redpanda commits for prolonged periods of time. by @andrwng in #31036
• Optimize the ACL authorization path for all callers (Kafka handlers, schema registry, Pandaproxy & Iceberg) by @WillemKauf in #30969
• Prevent oversized allocations/OOMs when using a large number of ACLs in redpanda by @WillemKauf in #30969
• The Iceberg Topics Coordinator will now commit to the Iceberg catalog in chunks, avoiding an OOM when the catalog has rejected Redpanda commits for prolonged periods of time. by @andrwng in #31036

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.12...v26.1.13

Bug Fixes

• Fixes a bug in which a generate_report() request to the transform system could result in a nullptr dereference at startup by @WillemKauf in #30910
• Fixes a bug in which a stale read in the l0 write scheduler could result in a division by zero (raising SIGFPE). by @WillemKauf in #30920
• Fixes a reactor stall seen when there are a large number of pending files in the Iceberg Topics coordinator. by @andrwng in #30880
• PR #30929 [v26.1.x] datalake: Fix deleted namespace race for REST_HADOOP catalog by @wdberkeley
• PR #30944 [v26.1.x] dt/kgo: surface worker crashes as descriptive errors by @nvartolomei

Improvements

• adds stuck raft0 escape hatches by @vbotbuildovich in #30945
• PR #30922 [v26.1.x] [CORE-16282] json: make the schema walk keyword-aware by @mnajda-redpanda

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.11...v26.1.12

Features

• rpk --print-tree: emits the full rpk command tree as a single JSON document, suited for LLMs and automations. by @r-vasquez in #30834

Bug Fixes

• Fix consumer group lag metrics inflated after retention or trim-prefix. by @bartoszpiekny-redpanda in #30870
• Fixed shadow link replication advancing the shadow partition start offset past the source partition's start offset when a replicator resumes after a shadow partition leadership change. by @Lazin in #30819
• Fixes a bug in which hung requests to the schema registry or in shadow linking could cause a deadlock during shutdown. by @WillemKauf in #30788
• Fixes a crash that could occur in the Cloud Topics metastore upon certain errors from during metastore database compaction. by @andrwng in #30775
• Fixes a wedge in multi-output transforms where a produce failure on one output topic silently stalled the processor instead of restarting it. by @WillemKauf in #30855
• Upgrade krb5 to 1.22.2 to address CVE-2026-40355 and CVE-2026-40356 (NegoEx parsing vulnerabilities). by @tyson-redpanda in #30874
• #30561 Fixed a bug in the schema registry where adding a new required field to a JSON schema was incorrectly allowed under BACKWARD compatibility mode. by @TheJohnMatti in #30563

Improvements

• Optimize compaction logic, especially for large batches. by @WillemKauf in #30760
• ct/l1: check is_linked() on owner shard by @WillemKauf in #30747
• build/deps: upgrade openssl to 3.5.7 by @tyson-redpanda in #30813
• ct/scale: raise fetch concurrency for cloud_topics MPT variants by @oleiman in #30867
• cluster: remove shard aggregation for max_offset and under_replicated_partitions by @WillemKauf in #30877

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.10...v26.1.11

Features

• New live-reloadable cluster configs oidc_http_proxy_username / oidc_http_proxy_password add HTTP Basic authentication to the OIDC forward proxy (oidc_http_proxy_url); set both to authenticate, leave unset for an anonymous proxy. The password is secret. by @nguyen-andrew in #30767

Bug Fixes

• Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). by @nvartolomei in #30590
• Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form, such as "string", and object form, such as {"type":"string"}. by @pgellert in #30641
• Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker. by @nvartolomei in #30706
• Fixes a bug in the feature_table in which nodes which are holding back the cluster-wide cluster_version, when decommissioned, result in the cluster_version never being updated until a restart/controller leadership move is forced. by @WillemKauf in #30636
• Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. by @wdberkeley in #30637
• Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). by @tyson-redpanda in #30572
• The day partition transform now produces a date-typed partition column (matching the Iceberg spec) instead of int. by @mmaslankaprv in #30534
• report Iceberg-disabled topics as DISABLED in translation_state response. by @bharathv in #30770

Improvements

• Added a new cluster property iceberg_default_schema_case_insensitive with possible values of yes, no, or auto, default is auto. This property determines whether the Iceberg subsystem compares field names case-insensitively or not. The auto value means the system will attempt to detect if it should use case insensitive comparison. This will happen if the detected REST catalog is AWS Glue, which addresses a sporadic issue with AWS Glue where it would return field names lower-cased instead of verbatim. by @wdberkeley in #30577
• Avoid recompression of unchanged batches in the local storage and cloud topics compaction implementation. by @WillemKauf in #30672
• Optimize the segment_meta_cstore::insert_entries() path for the generic append case. by @WillemKauf in #30610
• Prevent oversized allocations in the kafka layer when utilizing large consumer groups by @WillemKauf in #30753
• Purging an Iceberg table managed by the filesystem catalog will now delete all the table's files, not just the metadata files. by @wdberkeley in #30698
• The iceberg translation state REST endpoint now returns a partition state entry for every partition of the topic and reports the topic's partition_count. by @mmaslankaprv in #30657

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.9...v26.1.10

Bug Fixes

• Allow combining aws_sigv4 Iceberg REST catalog authentication with the sts cloud credentials source. by @nvartolomei in #30553
• Correctly decode variable-length Avro decimal payloads on the ingest path. by @nvartolomei in #30517
• Fix corruption of negative decimal partition values in Iceberg manifests for decimal columns whose precision does not require 16 bytes (e.g. decimal(10,2)). by @nvartolomei in #30517
• Fix parsing of Iceberg table metadata whose sort orders use the spec-canonical singular source-id field (e.g. metadata produced by Unity Catalog). by @mmaslankaprv in #30477
• Fix tiered storage I/O remaining throttled at the previously-configured rate after cloud_storage_max_throughput_per_shard was unset. by @nvartolomei in #30473
• Fixes an issue that prevented raft followers across high-RTT links from establishing connections long enough to receive heartbeat request replies. by @ballard26 in #30549
• #30502 Fixes a bug in which a double metric registration could occur when sts credentials were used for both iceberg and tiered_storage systems. by @WillemKauf in #30503

Improvements

• Backport features_auto_finalization cluster configuration option to allow opting out of automatic upgrade finalization before upgrading to v26.2. by @dotnwat in #30460
• PR #30507 cloud_topics/l1: fix UB in db_domain_manager error-logging paths by @Lazin
• PR #30509 storage: don't override with shard_local_cfg() in ntp_config helpers by @WillemKauf
• PR #30527 cluster: fix enterprise validation for iceberg enablement by @WillemKauf
• PR #30540 ct/l1: guard stop_collecting_logs() on local_is_initialized() by @WillemKauf
• PR #30542 rpk: bump Go to 1.26.3, x/net to v0.54.0 (Snyk findings) by @twmb

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.8...v26.1.9

Features

• New configuration: iceberg_rest_catalog_credentials_host: The hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog. May be required when the REST catalog uses a different credentials source than cloud storage — for example, if cloud storage is configured to use STS with a custom credentials host, but the REST catalog uses aws_instance_metadata, this should be set to 169.254.169.254 to prevent the cloud storage host override from applying to catalog credential requests. by @wdberkeley in #30446

Bug Fixes

• Avoid OOM under memory fragmentation when there are many ACLs. by @pgellert in #30401
• Fix Iceberg map columns being unreadable from strict Parquet readers (e.g. Apache Spark) due to a missing LogicalType.MAP annotation in the written Parquet schema. by @nvartolomei in #30457
• Fix an issue with Clout Topics garbage collection where deleting all cloud topics could leave stale objects in the bucket, forever. by @oleiman in #30283
• Iceberg REST catalog credential refresh requests were sent to the wrong host when cloud_storage_credentials_host was set. The host override intended for cloud storage was applied globally, causing catalog credential fetches to fail if the catalog used a different credentials source with a different expected endpoint. by @wdberkeley in #30446
• Upgraded libxml2 to v2.15.3 to fix CVE-2026-6732 type confusion vulnerability in XSD validation. by @tyson-redpanda in #30393
• #30437 Schema Registry: fixed protobuf compatibility checks incorrectly failing with MESSAGE_REMOVED when a map field is removed. by @QueLLL in #30438
• rpk/debug/bundle: dedup admin addresses across host forms by @hidalgopl in #30411
• PR #30313 kafka/server: cap fetch memory allocation at max message size limit by @ballard26

Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.7...v26.1.8