Kanidm Files

2026-08-02 - Kanidm 1.11.0

This is the latest stable release of the Kanidm Identity Management project. Every release is the combined effort of our community and we appreciate their invaluable contributions, comments, questions, feedback and support.

You should review our support documentation as this may have important effects on your distribution or upgrades in future.

Before upgrading you should review our upgrade documentation

1.11.0 Important Changes

• Passwords now have a max length of 128 UTF-8 characters (512 bytes). This is to prevent a rare class of denial of service during authentication requests.
• rlm_kanidm has been rewritten from python to rust. This greatly improves performance. No configuration changes are required for the container.

1.11.0 Release Highlights

• Security - High: SCIM Filter parsing had an incomplete fix for the previous parsing depth vulnerability. This meant that specially crafted queries were may allow stack exhaustion to occur leading to Denial of Service.
• Refactor early server startup logic to better handle early server shutdowns (#4468)
• Properly use Json types in some responses so that mime types are set correctly (#4480)
• Minor internal attribute syntax tidying (#4439)
• Improve credential update sessions to better indicate when a save is required (#4338)
• Add missing service-account manager attributes for search (#4381)
• Allow custom radius attributes in rlm_kanidm (#4370)
• Add live password feedback in forms (#4348)
• Limit password max length (#4442)
• Fix incorrect processing in bindmount logic that would cause errors when the mount already existed (#4433)
• Add missing attributes for the migration access checks (#4387)
• Add a missing alias for bindmount in unixd tasks (#4398)
• OAuth2 security hardening (#4380)
• Return unique ldap attributes even if requested multiple times (#4364)
• Move schema from the DB to memory (#4315)
• Add support for oidc max-age and prompt=login (#4336)
• Resolve an incorrect handling of commit flags in unixd transactions
• Prevent double deletes in some migration use cases
• Refactor of access control paths to remove some code duplication
• Revert OAuth2 JWT ClientID header which broke some clients (#4334)
• Allow SMTP urls in mail-sender (#4335)
• Remove debug symbols in release builds (#4319)
• Replace rlm_python with rlm_kanidm (#4179)
• Fix copy-paste of TOTP removal prompt (#4314)
• Resolve a mishandling of some webauthn fields being encoded with the wrong base64 padding options (#4312)