Anchore Enterprise Release Notes - Version 6.0.1

Anchore Enterprise v6.0.1

Enterprise Service

Requirements

• Anchore Enterprise v6.0.x requires PostgreSQL 17 or greater with the pg_cron extension installed and accessible by Anchore Enterprise. Pre-flight checks verify at startup that the database version and required extensions are working correctly, and the deployment will fail to start if these requirements are not met.
• SBOM ingestion in v6.0 drives larger parallel query plans against PostgreSQL, which use dynamic shared memory (/dev/shm on Linux). Docker’s default tmpfs of 64 MiB is insufficient for typical SBOM workloads. Operators running PostgreSQL on Kubernetes or self-managed hosts should size /dev/shm to at least 1 GiB - see Shared Memory for full guidance. Managed databases (Amazon RDS, Aurora) are unaffected.

Security

• Fixed an authorization flaw in the RBAC role-membership API CVE-2026-63727 where an authenticated user could grant themselves or others account-scoped roles without being authorized to do so. The role-member add endpoint now enforces the same per-account authorization checks as the corresponding delete endpoint. Upgrading to v6.0.1 is recommended for all affected deployments.

Recommended Component Versions

Anchore Helm Chart can be found at https://github.com/anchore/anchore-charts