BYOC 10.2026

Overview

Ververica Cloud 10.26 is a security and storage release for Bring Your Own Cloud. Artifact uploads and downloads now run through your data plane, so the control plane no longer needs direct access to your workspace storage. The release also adds an API to revoke a Single Sign-On user's access, applies role changes without delay, and fixes role resolution, workspace creation, and artifact downloads through the public API. Updated third-party dependencies address known vulnerabilities.

New Features and Improvements

Artifact Transfer Through Your Data Plane

Presigned URLs for artifact uploads and downloads are now signed by the agent in your data plane, with its own cloud credentials, instead of by the Ververica control plane. The console uploads files directly from your browser to the workspace bucket, and Flink log access also goes through the agent. This removes the control plane's need for direct access to your workspace storage, on AWS and on Azure.

Downloads open through a signed URL in the same tab and are saved under the artifact's own file name. A failed download now shows an error, instead of saving the error response to disk as the JAR file. A presigned URL is valid for 15 minutes to start a transfer.

For storage that your users' browsers cannot reach, Ververica can enable relay transfer for your account on request. Files then stream through the secure agent tunnel and are never stored at Ververica. On relay accounts, job JAR files can be up to 1 GB. UDF, connector, and catalog JAR files stay at 200 MB.

What this means for you:

• Your workspace bucket's CORS configuration must allow the Ververica Cloud console origin, the PUT method (GET is optional), and the Content-Type header. On Azure, also allow the x-ms-blob-type header. Your users' browsers must be able to reach the bucket. Otherwise users see the cloud provider's own "not authorized" error.
• Public API: on a workspace without relay, artifacts:download answers with a redirect to a signed URL. Make sure your API client follows redirects.

Learn More: Artifacts

Revoke a Single Sign-On User's Access

When you disable or delete a user in your identity provider, their Ververica Cloud session used to stay valid until it expired. Organization administrators can now revoke access for a single Single Sign-On user through the API, for SAML and OIDC connections. Within about 10 seconds, the user's sessions, refresh tokens, and personal API tokens stop working. You can list active revocations and lift one later, after which the user can sign in again.

Revocation is available through the API only.

Role Changes Apply Without Delay

Changes to teams, groups, and role bindings now take effect within one synchronization cycle. Deleting a team now removes the workspace access it granted to its members.

When two role bindings give the same user or group access to one workspace or namespace, both roles now apply. Previously, only the last synchronized role applied.

Bug Fixes

Strongest Role on the Dashboard

A user in several Single Sign-On groups with different roles on the same workspace saw an arbitrary one of those roles on the dashboard, for example Viewer instead of Admin, and dashboard actions followed that role. The dashboard now shows the strongest role. Users who saw a weaker role now get the dashboard actions they already held.

Members List for Administrators Invited From Outside the Organization

An administrator invited to an organization workspace from outside the organization saw an empty Members list. The list now shows the workspace members. These administrators cannot edit or remove members yet.

Single Sign-On Login After an Identity Provider Change

After an organization pointed its Single Sign-On configuration to a new identity provider or realm, users who had already signed in failed with a misleading "incorrect credentials" error. These users are now linked again to their existing profile when they sign in through the new identity provider, and keep their workspaces and roles. Only when the email is already linked to a different Single Sign-On connection does the login page report the conflict and ask the user to contact an administrator. Matching of Single Sign-On users by email is also limited to the user's own organization.

Storage URI Validated at Workspace Creation

Workspace creation accepted a malformed storage URI, for example one containing a space, and failed a few minutes later with a generic error that did not name the cause. The storage URI is now validated when you create the workspace, in the console and in the API, and the error names the field. Leading and trailing whitespace is trimmed.

Artifact Downloads Through the Public API

Downloading an artifact with the public API v1 artifacts:download endpoint returned HTTP 400 with a corrupted file in the response body, and large files failed with HTTP 500. The endpoint now returns the exact file content, or a redirect to it, and failures return their actual status code.

Team Role Bindings

The role binding API accepted a team ID that did not exist or belonged to another organization, and a binding whose team had been deleted could not be removed. Invalid team IDs are now rejected, and these bindings can be edited and removed.