v26.2 Changelog for Cloud

### Security and access control fixes[​](#security-and-access-control-fixes "Direct link to Security and access control fixes")

- Fixed missing access check in `SYSTEM SYNC FILE CACHE`. [#92372](https://github.com/ClickHouse/ClickHouse/pull/92372) ([Kseniia Sumarokova](https://github.com/kssenii)).
- Fixed incorrect logic in access grant checks for wildcard grants that was too restrictive. [#92725](https://github.com/ClickHouse/ClickHouse/pull/92725) ([pufit](https://github.com/pufit)).
- Prevented users from getting the list of columns from a table without `SHOW COLUMNS` permission using the `merge` table engine. [#93695](https://github.com/ClickHouse/ClickHouse/pull/93695) ([János Benjamin Antal](https://github.com/antaljanosbenjamin)).
- Fixed integer overflow vulnerability in `groupConcat` state deserialization that could cause memory safety issues. [#93426](https://github.com/ClickHouse/ClickHouse/pull/93426) ([Raufs Dunamalijevs](https://github.com/rienath)).
- Validated decompressed buffer size is as expected. [#93690](https://github.com/ClickHouse/ClickHouse/pull/93690) ([Raúl Marín](https://github.com/Algunenano)).
- Fixed revoking default roles. [#96103](https://github.com/ClickHouse/ClickHouse/pull/96103) ([Vitaly Baranov](https://github.com/vitlibar)).
- Fixed `AccessRights::contains` returning incorrect results with partial revokes. [#96170](https://github.com/ClickHouse/ClickHouse/pull/96170) ([pufit](https://github.com/pufit)).
- Fixed updating row policies assigned to the initial user in distributed queries. [#95469](https://github.com/ClickHouse/ClickHouse/pull/95469) ([Vitaly Baranov](https://github.com/vitlibar)).
- The password argument of the `redis` table function is now masked in logs and system tables. [#95325](https://github.com/ClickHouse/ClickHouse/pull/95325) ([Janos Benjamin Antal](https://github.com/antaljanosbenjamin)).
- Fixed memory leak of BIO objects when reading X509 certificates. [#96885](https://github.com/ClickHouse/ClickHouse/pull/96885) ([Alexey Milovidov](https://github.com/alexey-milovidov)).
- Validated witness version in bech32 to avoid buffer overflow. [#96671](https://github.com/ClickHouse/ClickHouse/pull/96671) ([Raúl Marín](https://github.com/Algunenano)).
- Fixed slow performance when querying system tables with a user that had limited grants on many databases. [#95874](https://github.com/ClickHouse/ClickHouse/pull/95874) ([pufit](https://github.com/pufit)).

### Backup and restore fixes[​](#backup-and-restore-fixes "Direct link to Backup and restore fixes")

- Fixed the `Couldn't pack tar archive: Failed to write all bytes` error caused by an incorrect archive entry size header. [#92122](https://github.com/ClickHouse/ClickHouse/pull/92122) ([Julia Kartseva](https://github.com/jkartseva)).
- Fixed server crash when many concurrent backups clashed over the same files. [#93659](https://github.com/ClickHouse/ClickHouse/pull/93659) ([Alexey Milovidov](https://github.com/alexey-milovidov)).
- Fixed stack overflow when creating archive-based backups (`.zip`, `.tzst`) to a `plain_rewritable` object storage disk. [#96872](https://github.com/ClickHouse/ClickHouse/pull/96872) ([Alexey Milovidov](https://github.com/alexey-milovidov)).
- Fixed server crash when backup failed due to full disk or other I/O errors. [#96873](https://github.com/ClickHouse/ClickHouse/pull/96873) ([Alexey Milovidov](https://github.com/alexey-milovidov)).
- Fixed segfault in `StorageKeeperMap` backup due to use-after-free. [#97336](https://github.com/ClickHouse/ClickHouse/pull/97336) ([Alexey Milovidov](https://github.com/alexey-milovidov)).

### Crash and stability fixes[​](#crash-and-stability-fixes "Direct link to Crash and stability fixes")