Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — September 9, 2026

Release Date: September 9, 2026
Release Type: Mixed (New Features, Bug Fixes, Security Fixes)

Overview​

This release opens up breach exposure so you can see the individual breaches behind an identity's risk, rather than a single exposure finding.

  • Breach details on the identity — see each breach an identity appears in, what data it exposed, when it happened, and how large it was.

New features​

Breach details for an identity​

Breach exposure previously told you that an identity appeared in a known breach. You can now see which breaches, and what each one exposed.

On a person's identity page, the breach exposure risk now carries the individual breach records behind it.

What you get:

  • The breaches that matter first. Two breaches are highlighted up front — the most severe one and the most recent one. When the same breach is both, it is labelled as such rather than shown twice.
  • What each breach exposed. Every record names the breach and the domain of the breached site, describes what happened in plain language, and lists the categories of data exposed, such as passwords or email addresses.
  • How big and how old. Each record shows the number of accounts involved, the date the breach occurred, and the date it was publicly disclosed.
  • Severity, and where the data came from. Each breach carries its reported severity, and is marked when the data came from credential-stealing malware rather than a website compromise — a distinction that changes how urgently you should respond.
  • The full list. Where an identity appears in many breaches, an All breaches view lists them all, sorted the way you choose. Long lists are paged, and the view tells you how many of the total you are seeing.

Fields that the underlying breach intelligence does not report are left empty rather than guessed at.

Why it matters: a single breach-exposure finding tells you to act but not how urgently. Knowing that an identity's password appeared in a recent credential-stealing malware dump — rather than in a decade-old forum leak — is the difference between a routine reset and an immediate one.

Risk icons on the identity and user cards now also carry tooltips explaining what each one measures.

To learn how Mesh derives breach exposure, see Risks.

Bug fixes​

Widgets no longer need a manual refresh to load​

Some widgets could fail on first load with "Widget did not load data — try refreshing", and then work after a refresh. Interrupted queries behind a widget are now retried automatically, including cases where the interruption arrived looking like a successful response.

On-prem agent details and status​

  • The Cert KID shown for an on-prem agent is now the certificate's key identifier. It previously showed an unrelated internal identifier from the enrollment activity.
  • The stale-agent banner no longer reads "no heartbeat since —" for an agent that has never reported in. An agent that has never connected is now described as such.

See On-prem connectors.

Security fixes​

  • CVE-2026-56854 — completed the rollout of the updated Go cryptography library across the remaining platform components.
  • CVE-2026-84304 — completed the rollout of the updated gRPC library across the remaining platform components.