Redis Software for Kubernetes 7.4.6-11 (August 2026) release notes
This is a maintenance release to support Redis Software version 7.4.6-283.
| Redis Enterprise for Kubernetes |
|---|
Highlights
This is a maintenance release to support Redis Software version 7.4.6-283. It fixes a high-severity bug with security implications that affected Active-Active databases. For version changes, supported distributions, and known limitations, see the release notes for 7.4.6.
Security
A high-severity bug with security implications affected Active-Active databases managed by the Redis Software for Kubernetes operator. Upgrade to operator version 7.4.6-11 or later on this release line to get the fix.
When the operator applied a configuration update to an Active-Active database, it rebuilt and sent the database's entire configuration, but only re-read a credential from its Kubernetes secret if it believed that specific secret had changed. Any update triggered by something else therefore sent the password as empty, and on operator versions before 8.2.0-12, also cleared the mutual TLS (mTLS) client certificates.
Either of the following triggered such an update:
- Any configuration change on the Active-Active database, such as eviction policy, memory size, or backup settings, made by a user or by automation tooling such as GitOps.
- A modification of the backup secret or a client certificate secret on the cluster, even with no configuration change. The operator re-read the touched secret correctly but wiped the password, because its secret was not the one that changed.
The impact was two-sided:
- Availability: applications connecting with the password failed on every new connection. Existing connections kept working, so the failure looked intermittent.
- Security: the database simultaneously accepted connections with no credentials at all, and with the mTLS variant, accepted clients without certificates. Nothing alerted and the database reported healthy, so a database could run exposed without anyone noticing.
This affected all released operator versions since the feature was introduced in early 2023. The fix prevents the credential wipe and automatically repairs already-affected databases when you upgrade the operator. No additional steps are required.
The fix is available in operator versions 7.4.6-11, 7.8.6-20, 7.22.2-45, 8.0.20-27, and 8.2.0-15.
Downloads
- Redis Enterprise:
redislabs/redis:7.4.6-283 - Operator:
redislabs/operator:7.4.6-11 - Services Rigger:
redislabs/k8s-controller:7.4.6-11
OpenShift images
- Redis Enterprise:
registry.connect.redhat.com/redislabs/redis-enterprise:7.4.6-283.rhel8-openshift - Operator:
registry.connect.redhat.com/redislabs/redis-enterprise-operator:7.4.6-11 - Services Rigger:
registry.connect.redhat.com/redislabs/services-manager:7.4.6-11
OLM bundle
Redis Enterprise operator bundle: v7.4.6-11.0