Skip to content

infisical

v0.161.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

acme certificate-management cli environment-variables go node-js
+9 more
pki postgresql private-ca secrets-management secret-manager secret-scanning security security-tools typescript

Affected surfaces

auth rbac

Summary

AI summary

Broad release touches https://github.com/Infisical/infisical/pull/6890, https://github.com/Infisical/infisical/pull/6879, https://github.com/Infisical/infisical/pull/6870, and https://github.com/Infisical/infisical/pull/6849.

Full changelog

Changed

  • Allow external account Google Cloud authentication (https://github.com/Infisical/infisical/pull/6890)
  • Move project templates to advanced and add external KMS shortcut to new project modal (https://github.com/Infisical/infisical/pull/6879)
  • Re-structure organization navigation and move secret sharing to secrets management scope (https://github.com/Infisical/infisical/pull/6870)
  • Make GCP IAM token OAuth scopes configurable for dynamic secrets (https://github.com/Infisical/infisical/pull/6849)
  • Migrate networking gateway and relay cards to v3 and stabilize sub-tab layout (https://github.com/Infisical/infisical/pull/6838)
  • Migrate error page to v3 components (https://github.com/Infisical/infisical/pull/6836)
  • Migrate create/link organization group modal to v3 components (https://github.com/Infisical/infisical/pull/6828)
  • Only verify SSO emails if the provider reports them unverified (https://github.com/Infisical/infisical/pull/6830)
  • Migrate add members to project modal to v3 (https://github.com/Infisical/infisical/pull/6807)
  • Add fallback to list only authorized paths on Vault migration (https://github.com/Infisical/infisical/pull/6814)
  • Adjust padding when in grid card view on project selection page (https://github.com/Infisical/infisical/pull/6889)
  • Refactor secrets buttons (https://github.com/Infisical/infisical/pull/6858)
  • Update 404 styling and flavor (https://github.com/Infisical/infisical/pull/6875)
  • Change secret request copy on overview page (https://github.com/Infisical/infisical/pull/6796)

Added

  • Use organization ID as ExternalID for certificate manager AWS connections (https://github.com/Infisical/infisical/pull/6883)
  • Auto-create a personal organization on sign-up from SSO (https://github.com/Infisical/infisical/pull/6877)
  • Add unexportable flag to KMS keys (https://github.com/Infisical/infisical/pull/6848)
  • Group certificate resources under a navigation section (https://github.com/Infisical/infisical/pull/6839)
  • Add support for revoking certificates using thumbprints (https://github.com/Infisical/infisical/pull/6833)
  • Add get-by-id route to webhooks and allow machine identity authentication (https://github.com/Infisical/infisical/pull/6818)
  • Add ability to clone certificate profiles (https://github.com/Infisical/infisical/pull/6816)
  • Add PKI Signer connect helper (https://github.com/Infisical/infisical/pull/6811)
  • Add handlebar templates for permissions (https://github.com/Infisical/infisical/pull/6809)
  • Add new template function for Kubernetes operator (https://github.com/Infisical/infisical/pull/6790)
  • Add webhook type for triggered honey tokens (https://github.com/Infisical/infisical/pull/6759)
  • Implement usage metering pipeline for License Server v2 (https://github.com/Infisical/infisical/pull/6827)
  • Revamp PAM checkpoint 4 (https://github.com/Infisical/infisical/pull/6853)
  • Revamp PAM checkpoint 2 (https://github.com/Infisical/infisical/pull/6795)
  • Fix shadow mismatches in Go and Node.js (https://github.com/Infisical/infisical/pull/6863)
  • Ensure only versions under v1 can be made to release in GitHub (https://github.com/Infisical/infisical/pull/6886)
  • Document CLI migration guide for Cloudsmith repository transition to artifacts-cli.infisical.com (https://github.com/Infisical/infisical/pull/6881)
  • Add secrets management walkthrough videos to documentation (https://github.com/Infisical/infisical/pull/6788)
  • Update README to reflect full product positioning and product lineup (https://github.com/Infisical/infisical/pull/6857)
  • Update README to reflect full product positioning and product lineup (https://github.com/Infisical/infisical/pull/6819)

Fixed

  • Add ServiceConfig SCIM endpoint and resolve duplicate user error (https://github.com/Infisical/infisical/pull/6885)
  • Validate and normalize generated usernames for dynamic secrets (https://github.com/Infisical/infisical/pull/6878)
  • Fix React Select component spread to not overwrite styling (https://github.com/Infisical/infisical/pull/6876)
  • Run 5 processBucketEvents in parallel (https://github.com/Infisical/infisical/pull/6869)
  • Handle NetScaler certificate sync race conditions when same certificate is used across multiple syncs (https://github.com/Infisical/infisical/pull/6850)
  • Preserve certificate subject attributes across ACME issuance and discovery (https://github.com/Infisical/infisical/pull/6845)
  • Resolve failing Go parsing for no-verify (https://github.com/Infisical/infisical/pull/6841)
  • Add redirects for moved PKI certificate-syncs pages in documentation (https://github.com/Infisical/infisical/pull/6835)
  • Bump validation and forbidden modal z-indexes to not compete with v2 modals (https://github.com/Infisical/infisical/pull/6831)
  • Resolve email not sending for an edge case in SSO (https://github.com/Infisical/infisical/pull/6826)
  • Gate certificate manager request access on request-access permission (https://github.com/Infisical/infisical/pull/6810)
  • Fix empty environments on overview page (https://github.com/Infisical/infisical/pull/6847)
  • Guard createOnUpdateTrigger in add-certificate-requests migration (https://github.com/Infisical/infisical/pull/6763)
  • Guard webauthn down() trigger drop with hasTable check (https://github.com/Infisical/infisical/pull/6707)
  • Guard against missing organization row in validateJWT (https://github.com/Infisical/infisical/pull/6694)
  • Guard JSON.parse on attacker-controlled RelayState in SAML (https://github.com/Infisical/infisical/pull/6691)
  • Show 'Connection Required' instead of 'Expected object, received null' when cancelling new connection dialog (https://github.com/Infisical/infisical/pull/6496)

New Contributors

  • @jaydeep-pipaliya made their first contribution in https://github.com/Infisical/infisical/pull/6707
  • @cody9swann made their first contribution in https://github.com/Infisical/infisical/pull/6838
  • @Manibharadwaj made their first contribution in https://github.com/Infisical/infisical/pull/6763
  • @MohdFaizan097 made their first contribution in https://github.com/Infisical/infisical/pull/6496
  • @Vligai made their first contribution in https://github.com/Infisical/infisical/pull/6878

Full Changelog: https://github.com/Infisical/infisical/compare/v0.161.0...v0.161.1

Security Fixes

  • Guard JSON.parse on attacker‑controlled RelayState in SAML
  • Guard against missing organization row in validateJWT
  • Gate certificate manager request access on request‑access permission
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track infisical

Get notified when new releases ship.

Sign up free

About infisical

Infisical is the open-source platform for secrets, certificates, and privileged access management.

All releases →

Related context

Earlier breaking changes

  • v1.0.0 Shared GitHub App host now bound to INF_APP_CONNECTION_GITHUB_APP_HOST environment variable.

Beta — feedback welcome: [email protected]