Self-Hosted Weekly: Week 38, 2026. Keycloak 6 CVEs, Nextcloud 35, Postgres 19 Slips
Your identity provider shipped six CVEs in one patch, your file server got a major version, and the database everyone expected in September became an October release. Two projects also changed what "open source" means for them, one by licence and one by walking away. Here's what mattered this week.
1. Keycloak 26.7.4 fixes six CVEs, including an impersonation escalation
Keycloak 26.7.4 landed on September 16 with six security fixes. The one to read twice is CVE-2026-17526: a user holding the "impersonation" role could impersonate a realm administrator. The rest: an unauthenticated denial of service via locale caching, a username takeover that locks the victim out, a percent-encoded semicolon that bypasses matrix parameter stripping, replayed artifacts accepted on MySQL and MariaDB, and a zlib state leak in the SAML redirect helpers. The 26.6.2 performance regression is fixed too.
Our take: Impersonation is a role people hand to support staff and forget about. Before you patch, list who has it. After you patch, ask why they still do. If you run Keycloak on MySQL or MariaDB, the replay fix is not optional either.
2. Nextcloud Hub 26 Summer ships as server 35
Nextcloud Hub 26 Summer was announced on September 16, a day after the v35.0.0 server tag. Headline items: a new Teams app that gives each team its own space with auto-created folders, team-owned boards and collectives, and admin-set quotas. Photos got a full redesign with a flexible grid, map exploration, trip grouping and year recaps. Office arrives on the desktop for Windows, Linux and macOS. Also new: one-time passwords on file shares.
Our take: Teams is the feature to test. Nextcloud already had teams (formerly circles) as a grouping concept; what is new is a dedicated app that gives them storage, ownership and quotas. The Photos redesign is the more immediate win if you deployed Nextcloud as a Google Photos exit.
3. Immich 3.2 lets trusted users share face recognition
Immich v3.2.0 shipped September 10, with 3.2.1 and 3.2.2 following on September 14 and 15. The big addition is cluster groups: invite users you trust and face recognition works across everyone's shared assets, with a bigger pool of faces to cluster on. Also new: a Search API v2 with album scoping and AND/OR filters, a redesigned search modal, tag-based workflow triggers, and a docker compose builder.
Our take: Cluster groups require resetting facial recognition for every user in the group, and the names and birth dates you assigned are lost in that reset. That is a real cost on a large library. Do it once, deliberately, and not on a Friday evening. If you are on Immich 3.2.0, move to 3.2.2 first.
4. Valkey 9.2 RC1 previews forkless snapshots and ACL roles
Valkey 9.2.0-rc1 arrived September 16. Two features stand out: opt-in forkless RDB snapshots, which remove the fork-and-copy-on-write memory spike that has bitten Redis operators for a decade, and named ACL roles, so you define a permission set once and attach it to users. Also in: server-side hot key detection, LZ4 compression for RDB files and replication streams, and XACKDEL and XDELEX for streams.
Our take: Forkless snapshots will not show up in a benchmark and will save you at 3 a.m. anyway. It is opt-in and this is a release candidate, so put it on a replica first. Valkey is doing what a fork is supposed to do: shipping operator features on its own roadmap instead of tracking upstream.
5. PostgreSQL 19 is now an October release
As of September 14, PostgreSQL 19 has no release candidate date. Beta 4 is scheduled for September 24 and the stated goal is GA by the end of October, against September 25 for version 18 last year. Four features have been reverted, including SQL/PGQ property graphs and GROUP BY ALL, and five open items are still contested.
Our take: This is the process working. Eight large features landed in the five weeks before the April freeze, and reverting the ones that are not ready beats shipping them. If you planned an autumn upgrade of PostgreSQL, test your extensions against Beta 4 and pencil in November.
6. Notifuse moves to BSL 1.1
Notifuse, the self-hosted email marketing platform, switched to Business Source License 1.1 with v40.0 on September 5, and v41.0 on September 17 added a sixth gated feature. Everything up to v39.x stays AGPL permanently, and each BSL release converts to AGPL four years after it ships. Without a licence key you lose six capabilities: a fourth workspace, restricted permissions, new Amazon SES tenants, template translations, single sign-on, and now audit logs. Keys validate offline.
Our take: This is one of the gentler BSL moves we have seen: a fixed conversion clock per release and a short, explicit list of gated features. It is still not open source, and any article or listing that calls it that needs a footnote from now on. If you run Notifuse and need SSO, budget for a key.
7. Papermerge starts a 30-day archive countdown
On September 5, Papermerge's creator opened an issue titled "Seeking Maintainer(s)": after nine years he is moving entirely to Papermerge Cloud, the open source version gets no new features from him, and if nobody steps up within 30 days the repository is archived. That clock runs out in early October.
Our take: Two weeks after File Browser, another self-hosted staple with a single maintainer is closing up. Same pattern: a healthy-looking project with a bus factor of one. If you run Papermerge, pin your current version now and start evaluating Paperless-ngx, which has a team behind it.
8. Rustls fixes a two-year-old plaintext handshake bug
Rustls 0.23.45 fixes a TLS 1.3 issue present since v0.23.13 in September 2024: handshake messages that should have been encrypted were accepted in plaintext. The transcript is still authenticated, so an on-path attacker cannot alter or complete a handshake, which is why the advisory is rated moderate. OpenSSL and BoringSSL are not affected.
Our take: Rustls sits under a growing share of Rust-written self-hosted services, usually through a dependency you have never looked at. Run cargo audit on anything you build yourself and watch for point releases on the images you pull.
What we're watching next week
PostgreSQL 19 Beta 4 on September 24. Whether the five contested items survive the September 19 commit freeze tells you what the final release looks like.
The Papermerge deadline. The 30-day window closes around October 5. A fork announcement is likely; a credible maintainer team is less so.
Ubuntu 26.10 on October 15. It moves cp, mv and rm to Rust coreutils, completing the transition. Those three were held back from 26.04 LTS for compatibility reasons, so test your shell scripts.
The bottom line
The security story is Keycloak: six CVEs in one patch, one of them a straight line from a support role to realm admin. Patch it this week.
The strategic story is the two ways a project stops being what you deployed. Notifuse changed its licence and told you exactly what changed. Papermerge kept its licence and is about to lose its maintainer. The first is annoying but predictable. The second leaves you running unpatched software in a year, and no licence scanner will catch it.
Running any of this yourself? Elestio keeps 400+ open source services patched, backed up and monitored, so weeks like this one mean an upgrade notification instead of a weekend.
See you in the next one 👋