Skip to content

Releases: gravitational/teleport

Release list

Teleport 18.10.0

Teleport 18.10.0 Latest
Latest

Choose a tag to compare

View all tags
@r0mant r0mant released this 09 Jul 00:01
v18.10.0
ddaa46b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Description

Directory sharing enhancements for Windows desktop access

Teleport now supports sharing multiple directories in a single RDP session. In
addition, users will be able to unmount shared directories without terminating
the session.

Windows sessions summaries

Identity Security now supports AI summarization for Windows desktop access
session recordings.

Other fixes and improvements

  • Resolve connectivity issues with the Redshift database through the MCP. #68337
  • Fixed premature session expiry for Application Access. #68337
  • Updated dependencies (addresses GO-2026-5547 and GO-2026-5694). #68152
  • Kubernetes resource RBAC now honors a wildcard (*) verb regardless of its position in the verbs list, including when introduced via trait templating. #68143
  • Added the Sub CA tctl auth update-override command, a user-friendly alternative over tctl create -f or tctl edit ca_overrides. #68189
  • Kubernetes: adding an ephemeral container to a pod (pods/ephemeralcontainers) now requires both the exec and patch/update verbs in the same role's kubernetes_resources. Previously only patch/update was required. #68159
  • Invalid role expressions are now rejected at creation time. #67607
  • Reject wildcards in role.allow.request.search_as_roles and role.allow.review_requests.preview_as_roles at creation time. #67607
  • Add missing validation for role.allow.require_session_join and role.allow.join_sessions fields. #67607
  • Improved the rate of Azure VM auto-discovery and enrollment. #67941
  • Fixed cloud-hosted Slack plugin exposing credentials in request URLs. #68017
  • Fix an issue where the WebUI would prompt for MFA multiple times for admin actions (or outright fail for select commands) when sso is the only allowed second factor on the cluster. #67867
  • Prevent misrouting when multiple apps share the same public address. #67947
  • Fix MFA prompts to show correct --mfa-mode values for webauthn authenticators. #67971
  • Fixed HTTP application access connections returning repeated 403 errors after certificate renewal. When the certificate behind a long-lived connection expires, the proxy now sends Connection: close so the client reestablishes the connection with a renewed certificate instead of reusing a dead one. #68099
  • Add "tsh apps logins" command to query available logins for the given cloud application (currently only AWS is supported). #68052
  • Added the Sub CA tctl auth delete-override command, a user-friendly alternative over tctl edit ca_overrides or tctl rm ca_overrides. #68014

Enterprise:

  • Changed Sub CA RPCs to emit audit error events for all failures.
  • Fixed Access List review badge not appearing on the main page for users who are both an owner and a member of an Access List.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Assets 2
Loading

Teleport 18.10.0-rc.2

Teleport 18.10.0-rc.2 Pre-release
Pre-release

Choose a tag to compare

View all tags
@r0mant r0mant released this 07 Jul 01:29
v18.10.0-rc.2
423b4a0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous stable releases of Teleport at https://goteleport.com/download.

Loading

Teleport 18.10.0-rc.1

Teleport 18.10.0-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@r0mant r0mant released this 01 Jul 13:51
v18.10.0-rc.1
040a854
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous stable releases of Teleport at https://goteleport.com/download.

Loading

Teleport 18.9.2

Teleport 18.9.2

Choose a tag to compare

View all tags
@r0mant r0mant released this 29 Jun 14:46
v18.9.2
ed19c74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Description

  • Fixed desktop connection failures to Windows 11 / Windows Server 2025 instances. #67483
  • Fixed potential deadlock when reading access list owners from the cache as the cache becomes unhealthy. #68013
  • Added the Sub CA tctl auth create-override command, a user-friendly alternative over tctl create ca_override.yaml. #67983
  • Add --interactive flag to prompt for role from stdin if --interactive flag is provided. #67951
  • Fixed Teleport Connect file uploads for empty files. #67925
  • Added scope info to user metadata in audit events. #67413
  • Sanitized AWS console federation transport errors to avoid logging AWS session credential material. #67199
  • Joining agents and tsh now report a clean, actionable error when a proxy returns an unsuccessful response to a ping or find request. #67912
  • Reduced write load for the cluster state storage in clusters with large amounts of app resources. #62243
  • Updated moderated upload path validation to require an absolute path to a file to prevent confusion. #67741
  • Added support for the following Oracle Cloud regions: ap-kulai-2, sa-riodejaneiro-1, af-casablanca-1, and me-alrayyan-1. #67858
  • Add scope support for openSSH and proxy recording mode. #67271
  • Add locking mode, disconnect expired cert, enhanced session recording, and session recording mode to scoped roles. #67269
  • Fixed an issue where path separators could be included in scp file names during upload. #67772
  • Prevented users with the same name in different clusters from being able to cancel each others' remote port forwards. #67689
  • Fixed a preflight check in Server Discovery where the script would exit even though there was enough space in /opt/teleport. #67596
  • Fixed an issue in Server Discovery that would prevent suffixed installations in VMs using Ubuntu 25.10 or Ubuntu 26.04. #67709
  • Fixed an SSRF vulnerability in AWS application access where a crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to an attacker-controlled host. #67706
  • Cap AWS STS AssumeRole session duration to the Teleport identity TTL, including query-string AssumeRole requests and requests made with cached assumed-role credentials. #67704
  • Fixed an issue where bots could fail to join with missing identity groups or scope pin when deleted and recreated quickly. #67645
  • Update golang.org/x/crypto to v0.53.0. #67640
  • Fixed role impersonation incorrectly being affected by user allow/deny rules. #67691
  • Fixed Resource Constraints UI visibility for AWS Console app resources created via integrations or tctl. #67531
  • Fixed Windows and Linux desktop Connect dropdowns showing logins from roles the user can request but hasn't been granted. #67090
  • EKS agent enrollment installs at the cluster version. #66868

Enterprise changes:

  • Only process Okta assignments for groups and apps currently being synced.
  • Prevent user-deletion of Access Lists being synced by Okta integration.
  • Fix plugins metrics registration.
  • Updated Teleport Entra ID integration to support delta sync.
  • Add support for rate limiting in the Teleport SCIM Server.
  • Update golang.org/x/crypto to v0.53.0.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Loading

Teleport 18.9.2-rc.1

Teleport 18.9.2-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@r0mant r0mant released this 24 Jun 00:08
v18.9.2-rc.1
b2da497
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous stable releases of Teleport at https://goteleport.com/download.

Loading

Teleport 17.7.26

Teleport 17.7.26

Choose a tag to compare

View all tags
@r0mant r0mant released this 23 Jun 17:52
v17.7.26
02e9da4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Description

Breaking changes

Kubernetes API server proxy access

Access to the Kubernetes API server pods/{name}/proxy/{path},
services/{name}/proxy/{path}, and nodes/{name}/proxy/{path}
endpoints now requires the new proxy verb in kubernetes_resources.
Previously these endpoints were authorized as the get verb. Roles
that use the Kubernetes API server proxy must add "proxy" to the
relevant verbs list.

Other fixes and improvements

  • Fixed Teleport Connect file uploads for empty files. #67926
  • Fixed an issue where path separators could be included in scp file names during upload. #67773
  • Sanitized AWS console federation transport errors to avoid logging AWS session credential material. #67708
  • Fixed an SSRF vulnerability in AWS application access where a crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to an attacker-controlled host. #67707
  • Cap AWS STS AssumeRole session duration to the Teleport identity TTL, including query-string AssumeRole requests and requests made with cached assumed-role credentials. #67705
  • Fixed role impersonation incorrectly being affected by user allow/deny rules. #67690
  • Prevented users with the same name in different clusters from being able to cancel each others' remote port forwards. #67688
  • Update golang.org/x/crypto to v0.53.0. #67641

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Loading

Teleport 18.9.1

Teleport 18.9.1

Choose a tag to compare

View all tags
@r0mant r0mant released this 22 Jun 20:03
v18.9.1
26a099e
This commit was signed with the committer’s verified signature.
hugoShaka Hugo Shaka
SSH Key Fingerprint: TazwLNbqmOEN2i89dLFKPJxZh+q7Pj5GTJlXfzGEyEo
Verified
Learn about vigilant mode.

Description

  • Fixed a limitation in Kubernetes Access causing the agent to throttle at 5 exec/second.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Loading

Teleport 18.9.0

Teleport 18.9.0

Choose a tag to compare

View all tags
@r0mant r0mant released this 18 Jun 00:19
v18.9.0
5d695d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Description

Device Bound Session Credentials for App Access

Application access session cookies are now compatible with Google's Device Bound
Session Credentials, adding a layer of protection against session hijacking and
cookie theft.

High-DPI support for Windows desktop sessions

Remote desktop sessions now support high-DPI mode, improving the clarity and
quality of the display rendering on supported displays.

Sub-CA

Teleport now supports operating as a sub-CA of an external root for the Windows
Desktop and Database Client CAs. Subsequent releases will extend support for
other CAs.

Other fixes and improvements

  • Outdated agents joining via the legacy Auth HTTP endpoint now receive an explicit "client too old" error instead of a confusing 404. #67532
  • Rename --from/--to to --from-utc/--to-utc on recordings search to match the recordings ls flag naming convention. #67502
  • Improved performance and reduced resource usage of the auth service for clusters with large numbers of registered applications with per-session MFA enabled. #67471
  • Prevented ssh users from being able to cancel other users' remote port forwards. #67442
  • Improved application server resolution times for large number of applications. #62585

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Loading

Teleport 17.7.25

Teleport 17.7.25

Choose a tag to compare

View all tags
@mjsmithnh mjsmithnh released this 09 Jun 18:49
v17.7.25
This tag was signed with the committer’s verified signature.
mjsmithnh Matt Smith
SSH Key Fingerprint: k063nd9uhyHXLXwa+ccoCcVh0PqPinXMMjebsu4kOHk
Verified
Learn about vigilant mode.
6f690ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Description

  • Fixed minor formatting bug on tsh request show output. #67446
  • Prevented ssh users from being able to cancel other users' remote port forwards. #67443
  • Updated Go to 1.25.11. #67422
  • Fixed "error gathering metrics" log spam. #67352

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Loading

Teleport 18.9.0-rc.2

Teleport 18.9.0-rc.2 Pre-release
Pre-release

Choose a tag to compare

View all tags
@r0mant r0mant released this 09 Jun 00:58
v18.9.0-rc.2
b3f7c6a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous stable releases of Teleport at https://goteleport.com/download.

Loading