3.127.0+2026.11.03

Features

Keycloak user sync: Users added in Keycloak are now added to the list on the Users tab of the Organization page when the list loads, so they show up before they first sign in. A full sync also runs every 10 minutes. It adds new users and archives users that were removed from Keycloak, so a removed user can take up to about 10 minutes to be archived. On-premises installations no longer run the sync-keycloak-users-to-db CronJob. A server-scheduler deployment runs the sync instead, and scheduler.tasks.keycloakUsersSync.interval sets how often it runs. The auth.syncUsersSchedule and syncKeycloakUsersToDB Helm values have been removed. See Users.
Server log level (on-premises): You can now set the server log level with the log.level Helm value. The default is still debug.

Vulnerability Database Service
- NVD escapes special characters in CPEs with a backslash, for example cpe:2.3:o:cisco:ios:15.6\(1\)t1. These CPEs were parsed incorrectly. An escaped colon split the CPE in the wrong place, which shifted the vendor, product and version. Versions and version ranges kept the backslashes, so version matching against them failed. The backslashes are now removed during parsing, and the affected vulnerability data has been rebuilt.
- Synchronization with NVD failed when NVD closed the connection partway through a large download. Downloads from NVD are now compressed, and stalled downloads are retried.
- For RPM packages, a known fixed version could come from another product’s build that is incompatible with the build in your image. Known cases of these fixed versions are no longer reported.
New Context-Aware Rule Detection (CryptoScan)
- Added a CryptoScan check for compromised eMudhra certificates. Each match is reported as a high-severity crypto/certificate/compromised finding (CWE-1240, CWE-693).
Analysis Framework Enhancements
- Mitigate now reports the finding for the U-Boot bootdelay setting for every U-Boot environment it identifies in the image.

RBAC for users of other Keycloak clients: Users who signed in through a Keycloak client other than BinarlyClient, such as a custom client, were treated as API clients and skipped role-based access control. They now go through RBAC like other users. Only tokens of service accounts without an email address in Keycloak skip RBAC. Service accounts that have an email address now get the default roles instead of full access, so grant them the roles they need, as you would for any other user.

Image list on the finding details page: The list of images that contain a finding depended on which image you opened the finding details page from. Images where a rescan no longer confirmed the finding disappeared from the list when you switched to an image the finding is still attached to. The list is now the same from every image.

Archive action for products created outside the dashboard: Products created through the API had no Archive product action in their Actions menu on the Products page until you reloaded the page. The page now loads the missing permissions itself, so the action shows up without a reload. See Archiving a Product.

Grid cells in Safari: In Safari, grid cells could collapse and cut off their text. Grids now keep their minimum cell width in Safari, as they do in Chromium-based browsers.