Security and correctness. A BOLA/IDOR flaw in the consumer GET endpoints was closed, preventing cross-object access through the consumer lookup path. On the operator side, barbican-manage had its logging.setup() call reordered so early log output is captured correctly, and db_manage.py no longer injects the current working directory onto sys.path — a small but real hardening of the management tooling.

Docs. Policy documentation received a broad typo and wording pass, and the KEK rotation guide was corrected to state that new keys must be prepended rather than appended during rotation — a meaningful semantic fix for anyone following the procedure. The mailing list link was also refreshed.

Release plumbing. The stable/2026.2 branch was cut, with .gitreview, tox constraints, and master version markers updated in lockstep.