Skip to main content

Changelog for Ory Oathkeeper OEL

v26.3.4​

Metrics endpoints now support OpenMetrics and trace exemplars​

The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.

OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:

  • The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
  • The ory_x_popx_cockroach_transaction_retries_total counter attaches an exemplar whose value is the transaction's retry count when a transaction is retried during a traced request, and the trace records a db.transaction.retry span event. Dashboards can link retry spikes directly to the traces that caused them.

That counter's caller label now also more reliably attributes automatic CockroachDB transaction retries to the business operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence Transaction wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match specific caller label values may need updating, because existing label values change with this release.

26.3.3

This version contains only minor changes and improvements such as dependency updates.

v26.3.2​

Enforce a DNS-label boundary on wildcard return URLs and CORS origins​

A wildcard in a return URL or CORS origin is now honored only when the * is confined to a subdomain label and the host part after it is a registrable domain (an eTLD+1, such as https://*.example.com or https://*.example.co.uk). The wildcard then matches only hosts under that one customer-owned domain.

These forms are no longer honored, because each can match an attacker-registrable host:

  • dot-less, e.g. https://*foo.com (matches https://evilfoo.com);
  • public-suffix base, e.g. https://*.com, https://*.co.uk, https://*.vercel.app;
  • trailing or bare, e.g. https://www.example.*, https://*.

Only the host is checked: wildcards in the URL path are unaffected. Exact origins, the catch-all *, and Hydra's https://* ("all hosts for a scheme") are unchanged.

What enforces it​

  • Return URLs: Kratos drops unsafe wildcard allowed_return_urls entries when it loads its config, and they never match.
  • CORS origins: matching across Kratos, Hydra, Keto, Oathkeeper, and Talos enforces the same boundary at request time.

Breaking changes​

Replace any unsafe wildcard with the labelled https://*.example.com form, or list exact origins. Update serve.*.cors.allowed_origins and Kratos allowed_return_urls before upgrading; otherwise cross-origin requests and post-flow redirects from those hosts will be blocked.

26.3.1

This version contains only minor changes and improvements such as dependency updates.

26.3.0

This version contains only minor changes and improvements such as dependency updates.

26.2.22

This version contains only minor changes and improvements such as dependency updates.

26.2.21

This version contains only minor changes and improvements such as dependency updates.

26.2.20

This version contains only minor changes and improvements such as dependency updates.

26.2.19

This version contains only minor changes and improvements such as dependency updates.

26.2.18

This version contains only minor changes and improvements such as dependency updates.

26.2.17

This version contains only minor changes and improvements such as dependency updates.

26.2.16

This version contains only minor changes and improvements such as dependency updates.

26.2.15

This version contains only minor changes and improvements such as dependency updates.

26.2.14

This version contains only minor changes and improvements such as dependency updates.

26.2.13

This version contains only minor changes and improvements such as dependency updates.

26.2.12

This version contains only minor changes and improvements such as dependency updates.

26.2.11

This version contains only minor changes and improvements such as dependency updates.

v26.2.10​

Add rule ID and OpenTelemetry trace context to Oathkeeper logs​

Oathkeeper proxy and decision API log entries now include the matched access rule ID as rule_id and, when an OpenTelemetry span is in scope, the trace and span ID as otel.trace_id and otel.span_id. The trace fields use the same shape as other Ory services, so you can correlate Oathkeeper log entries with traces and with logs from upstream services without custom mapping.

v26.2.9​

Patch security vulnerabilities in dependencies​

Bump several dependencies to patched versions to address security advisories reported by Dependabot.

Notable updates:

  • github.com/jackc/pgx/v5 to v5.9.2 across all Go modules (SQL injection via placeholder confusion in dollar-quoted string literals).
  • github.com/moby/spdystream to v0.5.1 (denial of service on container runtime interface).
  • go.opentelemetry.io/otel to v1.41.0 (remote DoS amplification via multi-value baggage header).
  • postcss to >=8.5.10 (XSS via unescaped </style> in CSS stringify output).
  • uuid to >=14.0.0 (missing buffer bounds check in v3/v5/v6 generators).
  • @xmldom/xmldom to >=0.8.13 (XML node injection and uncontrolled recursion).
  • axios, follow-redirects, lodash, picomatch, brace-expansion, serialize-javascript, yaml, file-type, i18next-fs-backend, @nestjs/core to their respective patched versions.

v26.2.8​

SSRF protection improvements​

Error messages originating from the SSRF protection mechanism no longer leak IP addresses if the hostname resolves to an internal IP address. This prevents SSRF recon through user-supplied URLs and hostnames.

26.2.7

This version contains only minor changes and improvements such as dependency updates.

26.2.6

This version contains only minor changes and improvements such as dependency updates.

v26.2.5​

Fix shared mutable state in error handling​

Error globals such as herodot.ErrNotFound were package-level variables shared across all requests. Calling methods like WithReason or WithDetail mutated these variables in place and returned the same pointer, so any request that added context to an error — reason text, details, etc, modified the global. The next request to reach an error path using the same error inherited those stale details.

As a consequence, observability (logs, traces) for requests resulting in an error suffered from the same issue: some errors were reported with details belonging to an unrelated request, or with fields missing that should have been present.

The new API creates a fresh error instance on each call, so each request gets its own copy.

The following values were at risk of leaking into unrelated error responses:

  • HTTP cookie names (Kratos CSRF flow)
  • Entity UUIDs (identity, organization, etc)
  • OAuth2 error hints (Hydra and Kratos Hydra bridge)
  • OIDC provider URLs and raw upstream error responses (Kratos OIDC strategy)
  • External schema fetch URLs and HTTP status codes (Kratos schema handler)
  • JWT claims and issuers (Oathkeeper JWT authenticator)

No data was written to persistent storage or transmitted outside the error response. Any two requests hitting the same error path on the same node — even back-to-back with no concurrency — could exchange error details.

Under concurrent load, the shared writes also constitute a true data race, which can additionally produce errors in an inconsistent or partially written state.

This change has no externally observable effect other than fixing the information leak in error paths.

v26.2.4​

Migrate Helm chart repository URL from k8s.ory.sh to k8s.ory.com​

The Helm chart repository URL has been updated from k8s.ory.sh to k8s.ory.com. The old URL will continue to work with redirects for a limited time. Update your Helm repository configuration to use the new URL.

26.2.3

This version contains only minor changes and improvements such as dependency updates.

26.2.2

This version contains only minor changes and improvements such as dependency updates.

26.2.1

This version contains only minor changes and improvements such as dependency updates.

v26.2.0​

Improved handling of forwarded headers​

This release includes improvements to the handling of forwarded headers in Ory Oathkeeper. The change ensures that when the configuration serve.proxy.trust_forwarded_headers is disabled, all X-Forwarded* and the standard Forwarded headers are removed before processing and forwarding the request. Previously, only the X-Forwarded, X-Forwarded-Host, and X-Forwarded-Proto headers were removed. If the downstream service relies on any of the X-Forwarded* headers, it is recommended to enable the serve.proxy.trust_forwarded_headers configuration option to ensure proper handling of forwarded headers.

26.1.18

This version contains only minor changes and improvements such as dependency updates.

26.1.17

This version contains only minor changes and improvements such as dependency updates.

v26.1.16​

Pass through HTTP 429 rate-limit errors with upstream headers​

Oathkeeper now propagates rate-limit headers (Retry-After, X-Rate-Limit-, RateLimit-) from upstream services when returning HTTP 429 responses. Previously, rate-limit errors lost their headers during error handling, preventing clients from knowing when to retry. This fix also resolves a potential data race caused by mutating shared error sentinel values.

26.1.15

This version contains only minor changes and improvements such as dependency updates.

26.1.14

This version contains only minor changes and improvements such as dependency updates.

26.1.13

This version contains only minor changes and improvements such as dependency updates.

26.1.12

This version contains only minor changes and improvements such as dependency updates.

26.1.11

This version contains only minor changes and improvements such as dependency updates.

26.1.10

This version contains only minor changes and improvements such as dependency updates.

26.1.9

This version contains only minor changes and improvements such as dependency updates.

26.1.8

This version contains only minor changes and improvements such as dependency updates.

26.1.7

This version contains only minor changes and improvements such as dependency updates.

26.1.6

This version contains only minor changes and improvements such as dependency updates.

26.1.5

This version contains only minor changes and improvements such as dependency updates.

26.1.4

This version contains only minor changes and improvements such as dependency updates.

26.1.3

This version contains only minor changes and improvements such as dependency updates.

26.1.2

This version contains only minor changes and improvements such as dependency updates.

26.1.1

This version contains only minor changes and improvements such as dependency updates.

26.1.0

This version contains only minor changes and improvements such as dependency updates.

25.4.12

This version contains only minor changes and improvements such as dependency updates.

25.4.11

This version contains only minor changes and improvements such as dependency updates.

25.4.10

This version contains only minor changes and improvements such as dependency updates.

25.4.9

This version contains only minor changes and improvements such as dependency updates.

25.4.8

This version contains only minor changes and improvements such as dependency updates.

25.4.7

This version contains only minor changes and improvements such as dependency updates.

25.4.6

This version contains only minor changes and improvements such as dependency updates.

25.4.5

This version contains only minor changes and improvements such as dependency updates.

25.4.4

This version contains only minor changes and improvements such as dependency updates.

25.4.3

This version contains only minor changes and improvements such as dependency updates.

25.4.2

This version contains only minor changes and improvements such as dependency updates.

25.4.1

This version contains only minor changes and improvements such as dependency updates.

25.4.0

This version contains only minor changes and improvements such as dependency updates.

25.3.9

This version contains only minor changes and improvements such as dependency updates.

25.3.8

This version contains only minor changes and improvements such as dependency updates.

25.3.7

This version contains only minor changes and improvements such as dependency updates.

25.3.6

This version contains only minor changes and improvements such as dependency updates.

v25.3.5​

Change of base image​

The base image for OEL images is now set to "gcr.io/distroless/static-debian12:nonroot". Previously, it was "gcr.io/distroless/static-debian12:debug-nonroot", which included BusyBox (a minimal shell and basic debugging utilities). Debug images are still available using the "-debug" tag suffix.

25.3.4

This version contains only minor changes and improvements such as dependency updates.

25.3.3

This version contains only minor changes and improvements such as dependency updates.

2025-05-08​

Initial Ory Oathkeeper OEL release​

Changes:

  • fix security vulnerability classified as critical CVE-2025-22871
  • fix security vulnerability classified as high CVE-2025-30204 (GHSA-mh63-6h87-95cp)

No specific upgrade steps are required for this release. The Ory Kratos OEL image is now available in the Ory Enterprise Docker Registry.