Skip to content

teleport

v17.7.26 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Network Security
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

audit bastion certificate cluster database-access firewall
+13 more
firewalls go jumpserver kubernetes kubernetes-access pam postgresql rbac rdp security ssh teleport teleport-binaries

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Broad release touches Other fixes and improvements, Breaking changes, Description, and https://github.com/gravitational/teleport/pull/67926.

Full changelog

Description

Breaking changes

Kubernetes API server proxy access

Access to the Kubernetes API server pods/{name}/proxy/{path},
services/{name}/proxy/{path}, and nodes/{name}/proxy/{path}
endpoints now requires the new proxy verb in kubernetes_resources.
Previously these endpoints were authorized as the get verb. Roles
that use the Kubernetes API server proxy must add "proxy" to the
relevant verbs list.

Other fixes and improvements

  • Fixed Teleport Connect file uploads for empty files. #67926
  • Fixed an issue where path separators could be included in scp file names during upload. #67773
  • Sanitized AWS console federation transport errors to avoid logging AWS session credential material. #67708
  • Fixed an SSRF vulnerability in AWS application access where a crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to an attacker-controlled host. #67707
  • Cap AWS STS AssumeRole session duration to the Teleport identity TTL, including query-string AssumeRole requests and requests made with cached assumed-role credentials. #67705
  • Fixed role impersonation incorrectly being affected by user allow/deny rules. #67690
  • Prevented users with the same name in different clusters from being able to cancel each others' remote port forwards. #67688
  • Update golang.org/x/crypto to v0.53.0. #67641

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Breaking Changes

  • Access to Kubernetes API server proxy endpoints (`pods/{name}/proxy/{path}`, `services/{name}/proxy/{path}`, `nodes/{name}/proxy/{path}`) now requires the new `proxy` verb in `kubernetes_resources`; previously authorized as `get`.

Security Fixes

  • Fixed SSRF vulnerability where crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to attacker-controlled host (CVE not listed).
  • Sanitized AWS console federation transport errors to avoid logging AWS session credential material.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track teleport

Get notified when new releases ship.

Sign up free

About teleport

The easiest, and most secure way to access and protect all of your infrastructure.

All releases →

Related context

Earlier breaking changes

  • v18.10.0 Kubernetes ephemeral container addition now requires both exec and patch/update verbs.
  • v18.8.3 Embedded session helper disabled by default; enable via `TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC=no`.
  • v18.8.0 Roles with unknown fields rejected at create/edit instead of silently dropped.
  • v18.8.0 Teleport Connect automatic updates only; manual downgrades required.

Beta — feedback welcome: [email protected]