rqlite is a lightweight, open-source, fault-tolerant relational database built on SQLite and the Raft consensus protocol.
Versions 10.6.1 through 10.7.1 focus on four core themes: two important security fixes, encrypted automatic backups in the cloud, a fix for duplicate writes during internode retries, and more consistent HTTP API responses. Version 10.7.0 also upgrades SQLite to 3.54.1, and 10.7.1 fixes a minor Docker packaging issue.
The changes are backward-compatible. All operators are strongly encouraged to upgrade to 10.7.1 due to the security fixes included in this series.
Important Security Fixes and Auth Hardening
This release series resolves two security vulnerabilities. The more critical fix lands in version 10.6.4. Previously, if an unauthorized user had network access to a node’s Raft port, they could download a database backup. Although the node rejected the unauthorized inter-node backup request, it failed to close the connection and streamed the database anyway. While the Security Guide for rqlite has always stated the Raft port should not be accessible outside the cluster, version 10.6.4 ensures the connection is closed immediately, and checks authorization once before dispatching any inter-node command.
Version 10.6.3 addresses a second vulnerability by blocking SQLite ATTACH statements on the query database connection. Without this restriction, a user with only read/query permissions could attach to arbitrary SQLite files on the host filesystem.
Authentication also received general hardening across the series. Version 10.6.1 switches password comparisons to constant time. Version 10.7.0 tightens configuration loading: rqlite now rejects duplicate usernames, requires the auth config to be a valid JSON array, and validates the complete configuration before replacing existing credentials and permissions – leaving the active store unchanged if validation fails.
Encrypted Cloud Backups
Many organizations require database backups to be encrypted at rest using keys they control. Version 10.7.0 adds support for Server-Side Encryption (SSE) when running automatic backups to AWS S3, and Customer-Managed Encryption Keys (CMEK) when backing up to Google Cloud Storage.
Internode Retries and Duplicate Writes
When a client sends a write request to a follower, the follower forwards that request over an network connection to the Leader. Previously, rqlite would retry failed internode requests at least once – even when configured with max-retries set to zero – to handle failed requests. If a Leader applied a forwarded write but failed to respond to the follower in time, that retry could cause the follower to resend the write, resulting in duplicated data.
Version 10.7.0 fixes this. Nodes now use in-band signaling to tell cluster clients when to close a connection, allowing rqlite to detect stale connections without blindly retrying requests. And if max-retries is zero, rqlite will (correctly) no longer retry the forwarded request, eliminating the risk of duplicated writes.
Database Engine and SQLite 3.54.1
Version 10.7.0 upgrades the underlying SQLite engine to 3.54.1. Several subtle SQL, dump, and WAL edge cases were also resolved:
-
SQL Rewriting & Consistency: Version 10.6.1 fixes the rewriting of CURRENT_TIMESTAMP and related time functions, and conditionally rewrites SQL during queued writes. Version 10.7.0 ensures read requests using auto consistency resolve to the intended level.
-
SQL Dumps: Version 10.7.0 preserves table data in SQL dumps when table names contain single quotes or column names contain double quotes. It also matches table names passed to a SQL dump regardless of case, ensuring indexes and triggers are included.
More Consistent API Responses
Clients that automate cluster management can now rely on structured error responses across all administrative endpoints. Between versions 10.6.4 and 10.6.6, GET /leader, POST /leader, POST /promote, POST /demote, and DELETE /remove were updated to consistently return JSON error bodies on failure. Furthermore, POST /leader, POST /promote, and POST /demote now properly return HTTP 404 when the target node ID is not part of the cluster.
CDC Improvements
Change Data Capture continues to improve. In 10.6.1, the CDC system properly encodes non-finite floats and fixes the HTTP sink so it follows redirects properly. Version 10.6.2 populates CommitTimestamps in CDC event groups. Finally, version 10.7.0 ensures CDC events resolve column names even when a table is created and populated within the exact same transaction.
For full details, see the CHANGELOG. To discuss these releases or ask questions, join the rqlite Slack channel.