Nacos 3.2.4 alters default API and authentication behavior

The Nacos 3.2.4 release, dated August 27, 2026, introduces several changes focused on bug fixes, security enhancements, and usability improvements. Key updates include strengthened JRaft gRPC authentication, refined HTTP/gRPC authorization, and new outbound access controls for MCP tool imports. Additionally, deprecated AI APIs are now disabled by default, and private MCP imports require administrator-managed allowlists. These changes aim to improve security and operational consistency but also introduce breaking changes for certain configurations.

According to the project's GitHub release notes, operators should pay close attention to the irreversible enforcement of JRaft authentication and the default disabling of deprecated APIs. Before upgrading, it is critical to ensure that nacos.core.auth.server.identity.key and nacos.core.auth.server.identity.value are uniformly configured across all cluster members, as these values are not automatically synchronized. Operators relying on deprecated APIs or private MCP imports should either migrate to the canonical APIs or configure compatibility and allowlist settings as specified. Mixed-version rolling downgrades are no longer viable once JRaft authentication enforcement is active, which could impact rollback strategies.

This release highlights a common trend in modern AIOps projects: tightening security defaults while providing temporary compatibility options for migration. Operators should carefully assess their current configurations and dependencies to avoid disruptions during the upgrade process.