Releasesby GlyphLogical cluster ID OAuth extension no longer required for Kafka clients
The logicalCluster OAuth extension is no longer required for clients connecting to Dedicated, Freight, and Enterprise clusters with an lkc-based bootstrap URL, on any cloud or networking type.
Also shipped Sep 8, 2026Confluent in September 2026 →
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function . This feature is in Preview .
Add and drop hybrid table constraints online (General availability)
With this release, you can add and drop UNIQUE and FOREIGN KEY constraints on an existing hybrid table by using alter table . Previously, you had to define these constraints when you created the table, so adding a foreign key to a table that was already serving a workload meant recreating and reloading the table.
Shadow traffic for gateways (Preview)
With this preview release, you can use a shadow traffic gateway to send all production requests to a primary service endpoint while mirroring a percentage of those requests to one or more shadow endpoints. Responses from shadow endpoints aren't returned to clients.
The partner-powered AI features setting will be removed
On November 1, 2026, Databricks will remove the account- and workspace-level toggle for partner-powered AI features. Each workspace will keep its current setting value: if the setting is enabled, it stays enabled, and if it's disabled, it stays disabled. Removing the toggle doesn't change any setting values.
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available. Today, Lakeflow Connect ingests formula fields by taking a full snapshot on each pipeline run by default. When incremental formula field ingestion is generally available, full snapshots will no longer be the default.
ABAC DENY policies are in Beta
ABAC DENY policies are in Beta in Unity Catalog. DENY policies can be used to explicitly deny the MANAGE ACCESS CONTROL privilege to prevent specified principals, including object owners, from performing access-management operations. They always take precedence over any grant. For details, see ABAC DENY policies (Beta) .
More from Confluent CloudEvery Confluent Cloud release →
Oracle XStream CDC Source no longer requires SELECT_CATALOG_ROLE
The connector no longer requires granting SELECT_CATALOG_ROLE to the connect user; you can instead grant SELECT on an explicit list of catalog views.
Oracle XStream CDC Source supports Active Data Guard standby as source
For cascading downstream capture, the source connection can point at the Active Data Guard standby instead of the primary, offloading the initial snapshot and schema reads.
ksqlDB v8.1.0-41 bounds pull-query concurrency per cluster
Coordinator and router thread pools each accept up to 100 pending requests; requests beyond that are rejected with HTTP 429. Queries are cancelled server-side if the client disconnects.
ksqlDB validates property overrides against an allowlist
Server property overrides supplied through queries, such as SET statements, are now validated against an allowlist of approved properties by default, replacing the previous denylist. Overrides outside the allowlist are rejected.
Flink Table API 2.3-6 adds AI functions, changelog functions, artifact creation
Java plugin 2.3-6 and Python package 2.3.3 on Flink 2.3.0 add AI_SENTIMENT, AI_DETECT_PII, AI_FORECAST and AI_DETECT_ANOMALIES, FROM_CHANGELOG/TO_CHANGELOG support, and ConfluentTools.createArtifact(). Python Table API remains in Open Preview.
Advanced Security add-on in Limited Availability
Organization-level add-on bundling SCIM, self-managed encryption keys (BYOK), and higher limits for security resources such as identity pools and RBAC role bindings. Billed as a percentage uplift on eligible infrastructure charges.
SCIM user provisioning generally available
SCIM user provisioning is GA with the Advanced Security add-on. Your IdP becomes the single source of truth for SSO user accounts, automating provisioning and de-provisioning.
Flink materialized tables can adopt an existing Kafka topic
A CREATE OR ALTER MATERIALIZED TABLE statement can point at an existing table, and Flink adopts it in place, keeping the topic, its data, and its consumers. Previously a materialized table always created a new topic.