Stalwart 1.0.1 fixes tenant isolation and credential exposure

Security fixes released on 28 October

Stalwart 1.0.1, released on 28 October 2026, fixes a tenant-isolation flaw: tenant administrators with the impersonate permission could reach accounts belonging to other tenants. The release prevents tenant members from receiving that permission. This matters particularly to MSPs hosting several customers on one installation.

The release also fixes creation of config.json with permissions that could let other local users read data-store credentials. Operators should review the release, upgrade through their supported method, and check access permissions on existing configuration files. If credentials may have been exposed, investigate access and rotate them as appropriate.

Version 1.0.1 also changes telemetry metric names, so review monitoring dashboards and alerts when upgrading.

Moving from 0.16 requires migration

Stalwart 1.0.0 arrived on 26 October with a different database layout. A 1.0 server cannot open a 0.16 data store; replacing the binary is insufficient.

Follow the project's migration instructions. The source must first run 0.16.27. The migration tool copies settings and data into a new, empty store and supports incremental copies while the old server runs. The final copy requires stopping the old server. Back up the deployment, plan that interruption, and verify the copied data before completing the switch.

DKIM2 remains work in progress

Version 1.0.0 extends Stalwart's DKIM2 implementation with composite ML-DSA-44 and Ed25519 signatures. Its release notes target specification revision 07; the IETF draft advanced to revision 08 on 27 October. DKIM2 is still an Internet-Draft. These implementation changes create no new general sender requirement; keep existing SPF, DKIM and DMARC controls in place.