Elestio Catalog Updates: 47 New Releases This Week (August 16-22, 2026)

Forty-seven services in the Elestio catalog shipped new stable releases between August 16 and 22. Four of them warrant a security section of their own, and one is an unauthenticated account takeover in Keycloak. Here is everything worth knowing, sorted by category.

Security Alerts

Keycloak 26.7.2 (August 19) is the one to patch first. It closes eight vulnerabilities, including CVE-2026-18963, an unauthenticated account takeover via a reset-credentials flow bypass, and CVE-2026-15571, a predictable account-linking hash that lets a malicious OIDC client hijack accounts. Three more cover leaked client secrets, an admin permissions bypass, and hidden parent groups disclosed under FGAP v2. If Keycloak is your identity provider, upgrade today.

Redis 8.10.1 (August 17) is flagged SECURITY urgency and was backported across every supported branch at once, down to 6.2.24. The headline is a malicious RDB payload with an out-of-range SLOT_INFO slot id that corrupts memory during loading and may lead to remote code execution. Also fixed: CVE-2026-62356 (heap out-of-bounds write in CMSketch RDB loading), a TLS certificate authentication bypass via an embedded NUL byte in the Common Name, and three Vector Sets memory-safety bugs.

Grafana 13.2.0 (August 19) carries a fix for CVE-2026-17183, backported the day before to 13.1.4, 13.0.7, 12.4.9 and 12.3.11. Every supported branch has a patch.

Rocket.Chat 8.7.1 (August 19) ships a security hotfix alongside per-client rate limiting on the unauthenticated password recovery endpoint and improved SSRF protection in file downloads. It landed on seven other branches the same day, back to 7.10.15.

Databases

Redis 8.10.1 (August 17). A SECURITY-urgency release fixing an RDB parsing path that can reach remote code execution.

ClickHouse 26.7.5.10 (August 21). Stable bumps on the 26.5, 26.6 and 26.7 lines plus LTS patches for 26.3 and 25.8.

InfluxDB 3.11.2 (August 20). Maintenance patch on 3.x.

TimescaleDB 2.29.2 (August 18). Bug fixes for the hypertable and continuous aggregate paths.

Weaviate 1.38.11 (August 20). Async replication fixes, following 1.38.10 two days earlier with search REST endpoint improvements.

AI & GPU

RAGFlow 0.27.0 (August 19). The biggest AI release of the week by some distance. Over 700 pull requests merged, the task executor migrated to Go, a new model provider abstraction, ClickHouse integration, Mistral OCR and PowerPoint parsing, and an agentic search framework wired to Tavily, PubMed and ArXiv. Several CVEs fixed too.

Ollama 0.32.15 (August 20). Caches resolved model metadata between requests, cutting time to first token roughly in half. Version 0.33.0 is tagged but still a release candidate, so hold off unless you want the Claude Desktop integration early.

Langflow 1.11.4 (August 19). Stable patch while 1.12.0 stays in dev builds.

Gradio 6.25.0 (August 19). Component updates across the dataframe, image and 3D widgets.

Development

GitLab 19.3.0 (August 20). GitLab Secret Manager enters limited availability with secrets scoped by environment, branch and protection status, plus Kubernetes and Terraform support. Duo can now resolve merge conflicts on its own, and merge trains can be enforced project-wide from one setting.

Keycloak 26.7.2 (August 19). Eight CVEs, 19 bug fixes, Quarkus bumped to 3.33.3.1. See the alerts above.

Authentik 2026.8.0 (August 18). Sessions are now deleted when a user is deactivated, with back-channel logout sent automatically. Also fixes SCIM group membership removal and closes a CSRF exemption in dynamic client registration.

NocoDB 2026.08.1 (August 19). Realtime Presence gives every collaborator a colour that follows them cell to cell, with presence badges on open records. Folders group tables, documents and dashboards into collapsible sets. Both on self-hosted.

Directus 12.3.0 (August 18). New @directus/cli for syncing schema and config between instances, search-first AI tool discovery for chat and MCP, and a fix for storage connection leaks.

n8n 2.36.5 (August 21). Rapid patch cadence continued all week, with the 1.123.75 LTS line updated in parallel.

Maintenance updates landed for Strapi 5.52.1 (August 19), Hasura 2.50.1 (August 18), Jenkins 2.578 (August 18), ToolJet 3.20.214 LTS (August 19) and Budibase 3.42.0 (August 17).

Hosting & Infrastructure

Grafana 13.2.0 (August 19). Beyond the CVE, a real feature release: an import tab for alerting settings and notification templates, Git Sync webhooks with user attribution, and Redis TLS connections via rediss://.

Prometheus 3.14.0 (August 17). PromQL duration expressions are on by default and first_over_time graduates to stable. Adds Oracle Cloud service discovery, plus fixes for TSDB data loss and native histogram corruption after restart.

VictoriaMetrics 1.150.0 (August 17), SigNoz 0.138.0 (August 19) and Loki Operator 0.11.0 (August 18) round out observability.

Elsewhere, RabbitMQ 4.3.5 (August 17), Traefik 3.7.11 (August 21, with 2.11.55 alongside) and Uptime Kuma 2.5.3 (August 22) all shipped patches, the last correcting a version numbering slip in 2.5.1 and 2.5.2.

In object storage, SeaweedFS 4.44 (August 22) capped three releases in six days, and RustFS 1.0.0-rc.3 (August 21) moved the S3-compatible newcomer nearer 1.0.

Applications

WordPress 7.1 "Mary Lou" (August 19). Interactive state styling is the headline: hover, focus and active states configurable from the Site Editor without writing CSS. Two new core blocks arrive (Tabs and Playlist), Notes gain inline comments with @mentions, and image resizing moves from the server into the browser before upload.

Mastodon 4.7.0 (August 20). Local users' keypairs are now encrypted at rest, with RFC9421 HTTP Message Signatures and FEP-8b32 object integrity proofs. Remote accounts can change handles without creating duplicates. Plan the window carefully: migrations can run up to two hours on large servers, and dropping pre-4.3.0 cookies logs out older sessions.

Rocket.Chat 8.7.1 (August 19). Security hotfix plus SSRF hardening, backported to seven branches.

Chatwoot 4.17.0 (August 20). WhatsApp Cloud API and Twilio template management moves into Chatwoot and the API, macros run from the reply editor and command bar, and a Freshdesk importer arrives for contacts, tickets and notes.

Wekan 11.00 through 11.07 (August 17 to 21). A major version bump plus seven patches in five days. Fixes RouteBleed, an incompletely escaped dynamic regex, and makes Helm containers read Node.js heap limits from their cgroup.

Umami 3.3.1 (August 20). Hardens two-factor authentication when TWO_FACTOR_ENCRYPTION_KEY is missing or invalid, plus a migration normalizing legacy usernames.

Ghost 6.59.0 (August 19), Metabase 0.63.14.2 (August 21), Element Web 1.12.26 (August 18), Matomo 5.13.0 (August 16), Penpot 2.17.1 (August 17), Documenso 2.17.0 (August 19), ERPNext 16.32.3 (August 18), Invoice Ninja 5.13.33 (August 17), Vaultwarden 1.37.2 (August 22, required for Bitwarden clients on 2026.8.0 and later), Nextcloud AIO 13.5.0 (August 17) and Jitsi Meet stable-11189 (August 20) complete the list.

What Stood Out This Week

Keycloak 26.7.2 is not optional. An unauthenticated account takeover in the reset-credentials flow means an attacker needs nothing but network access to your login page. If Keycloak fronts your internal tooling, treat this as an incident, not a maintenance item.

Redis patched eight branches on one day. When a project backports all the way to 6.2, the underlying bug is serious. Anyone loading RDB files from a source they do not fully control, including a restored backup, is in scope.

RAGFlow 0.27.0 is a genuine architectural release. Moving the task executor to Go changes how the system scales, and the agentic search tooling turns it from a document Q&A app into something closer to a research agent.

WordPress 7.1 moved image resizing to the browser. Server-side resizing has been a quiet source of PHP memory exhaustion on small instances for years. Doing it client-side before upload removes a whole class of failed-upload support tickets.

Every service above is available as a fully managed deployment on Elestio, with updates, backups and monitoring handled for you. Browse the catalog at elest.io/fully-managed-services.

See you next Sunday for the next round 👋