teleport

v18.8.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Network Security

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

audit bastion certificate cluster database-access firewall

+13 more

firewalls go jumpserver kubernetes kubernetes-access pam postgresql rbac rdp security ssh teleport teleport-binaries

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 1mo

Teleport v18.8.3 tightens Device Trust challenge/response validation and disables the embedded session helper by default.

Why it matters: Security engineers must review signature handling changes (severity 80) and SREs should test sessions after the embedded helper is disabled unless overridden via TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC=no.

Summary

AI summary

Broad release touches Description, https://github.com/gravitational/teleport/pull/67447, https://github.com/gravitational/teleport/pull/67430, and https://github.com/gravitational/teleport/pull/67421.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	Tightened signature handling in Device Trust challenge/response validation. Tightened signature handling in Device Trust challenge/response validation. Source: llm_adapter@2026-06-05 Confidence: high	—
Security	High	Fixed device trust for remote users connecting to a trusted cluster. Fixed device trust for remote users connecting to a trusted cluster. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Security	High	Fixed TLS certificate error preventing connections to Amazon Keyspaces databases through Teleport. Fixed TLS certificate error preventing connections to Amazon Keyspaces databases through Teleport. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Security	High	Stopped traversing symlinks and allowing relative paths in moderated file transfers. Stopped traversing symlinks and allowing relative paths in moderated file transfers. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Security	Medium	Tightened default permissions when creating AWS configuration files. Tightened default permissions when creating AWS configuration files. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Breaking	High	Embedded session helper disabled by default; enable via `TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC=no`. Embedded session helper disabled by default; enable via `TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC=no`. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature
Feature	Medium	Added auto‑discovery of VMs in Azure VM Scale Sets to Terraform modules. Added auto‑discovery of VMs in Azure VM Scale Sets to Terraform modules. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Added secret lookup for `TeleportOIDCConnector.spec.google_service_account` in Kubernetes Operator. Added secret lookup for `TeleportOIDCConnector.spec.google_service_account` in Kubernetes Operator. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Added `web_terminal_clipboard_mode` role option to restrict web terminal copy‑paste. Added `web_terminal_clipboard_mode` role option to restrict web terminal copy‑paste. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Medium	Introduced `tsh workload-identity issue-jwt` command for human issuance of JWT‑SVIDs. Introduced `tsh workload-identity issue-jwt` command for human issuance of JWT‑SVIDs. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Feature	Medium	Added `identity/key-agent` service to enable `tbot` to generate un‑exfiltratable credentials. Added `identity/key-agent` service to enable `tbot` to generate un‑exfiltratable credentials. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Feature	Medium	Added support for allowing or denying AWS IAM join attempts using Organizational Units in current Organization. Added support for allowing or denying AWS IAM join attempts using Organizational Units in current Organization. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Feature	Low	Combined passkeys and MFA devices into one list on the account settings page. Combined passkeys and MFA devices into one list on the account settings page. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Dependency	Low	Updated Go runtime to version 1.25.11. Updated Go runtime to version 1.25.11. Source: llm_adapter@2026-06-05 Confidence: high	—
Dependency	Low	Bumped github.com/containerd/containerd from 1.7.30 to 1.7.32. Bumped github.com/containerd/containerd from 1.7.30 to 1.7.32. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Performance
Performance	Medium	Improved latency of SSH agent forwarding for multiple concurrent clients. Improved latency of SSH agent forwarding for multiple concurrent clients. Source: llm_adapter@2026-06-05 Confidence: high	—
Performance	Medium	Improved auth service performance and reduced resource usage for clusters with many registered Kubernetes clusters using per‑session MFA. Improved auth service performance and reduced resource usage for clusters with many registered Kubernetes clusters using per‑session MFA. Source: llm_adapter@2026-06-05 Confidence: high	—
Performance	Low	Reduced peak memory usage of SSH target resolution in Auth service instances. Reduced peak memory usage of SSH target resolution in Auth service instances. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Performance	Low	Improved reliability of clipboard sharing for remote desktop sessions in Teleport Connect and Chrome 144+ browsers. Improved reliability of clipboard sharing for remote desktop sessions in Teleport Connect and Chrome 144+ browsers. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Performance	Low	Reduced unnecessary S3 uploads for Athena audit log deployments publishing directly to SQS by applying correct message size limit when client has `sqs:GetQueueAttributes` permission. Reduced unnecessary S3 uploads for Athena audit log deployments publishing directly to SQS by applying correct message size limit when client has `sqs:GetQueueAttributes` permission. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix
Bugfix	High	Fixed Enhanced Session Recording bug causing Nodes to stop emitting BPF events in proxy recording mode. Fixed Enhanced Session Recording bug causing Nodes to stop emitting BPF events in proxy recording mode. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	High	Fixed fatal connection error in Windows Desktop sessions when creating files >4 GiB in shared directories. Fixed fatal connection error in Windows Desktop sessions when creating files >4 GiB in shared directories. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Medium	Fixed minor formatting bug on `tsh request show` output. Fixed minor formatting bug on `tsh request show` output. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Fixed installer script bug that incorrectly escaped special characters. Fixed installer script bug that incorrectly escaped special characters. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Fixed Teleport Connect logging last terminal input to `renderer.log` when session closes unexpectedly. Fixed Teleport Connect logging last terminal input to `renderer.log` when session closes unexpectedly. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Medium	Fixed `teleport-kube-agent` updater ignoring `podSecurityContext` value. Fixed `teleport-kube-agent` updater ignoring `podSecurityContext` value. Source: granite4.1:30b@2026-06-05-audit Confidence: low	—

Full changelog

Description

Fixed minor formatting bug on tsh request show output. #67447
The embedded session helper functionality introduced in v18.8.0 to improve memory usage and latency of SSH sessions is now disabled by default due to incompatibility with some endpoint protection services. It can be enabled by setting the TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC envvar to no. #67430
Updated Go to 1.25.11. #67421
Improved notification messaging for Slack and Discord access plugins. #67415
Added support for auto discovering VMs deployed in uniform Azure VM Scale Sets to terraform modules used in Auto Discovery. #67323
Added secret lookup support for TeleportOIDCConnector.spec.google_service_account to the Teleport Kubernetes Operator. #67309
Improved the latency of SSH agent forwarding used by multiple clients at once. #67305
Tightened signature handling in Device Trust challenge/response validation. #67302
Added web_terminal_clipboard_mode role option to restrict copying text from a web terminal SSH session. #67276
Improved performance and reduced resource usage of the auth service for clusters with large numbers of registered Kubernetes clusters with per-session MFA enabled. #67203
Fixed an issue where generated installer scripts could incorrectly escape special characters in some values. #67191
Fixed a bug in Teleport Connect where the last terminal input could be logged to renderer.log if the terminal closed on its own — for example, when a tsh ssh session is dropped by the remote side (idle timeout, network disconnection) after the user pasted content but before they pressed Enter. #67172
Fixed a Enhanced Session Recording bug in proxy recording mode that caused Teleport Nodes to stop emitting BPF events. #67155
Fixed the teleport-kube-agent updater not honouring the podSecurityContext value. #67097
Fixed device trust for remote users connecting to a trusted cluster. #67031
Improved performance and reduced resource usage of the auth service for clusters with large numbers of registered databases with per-session MFA enabled. #67029
NOCL: [v18] Bump github.com/containerd/containerd from 1.7.30 to 1.7.32 #67007
Reduced peak memory usage of SSH target resolution in Auth service instances. #67005
Introduced tsh workload-identity issue-jwt command for human issuance of JWT-SVIDs. #66995
Improved the reliability of clipboard sharing for remote desktop sessions in both Teleport Connect and browsers running Chrome 144+. #66979
Fixed a TLS certificate error that prevented users from connecting to Amazon Keyspaces databases through Teleport. #66974
Tightened default permission when creating AWS configuration files. #66941
Stopped traversing symlinks and allowing relative paths in moderated file transfers. #66796
Added identity/key-agent service to enable tbot to generate un-exfiltratable credentials. #66701
Reduced unnecessary S3 uploads for Athena audit log deployments that publish directly to SQS by applying the correct SQS message size limit when the client has sqs:GetQueueAttributes permission, instead of always using the 256 KB SNS limit. #66532
Combined passkeys and MFA devices into one list on the account settings page. #66435
Added support for allowing or denying AWS IAM join attempts using the account's Organizational Units in their current Organization. #66276
Fixed a fatal connection error that occurs in Windows Desktop sessions when attempting to create a file larger than 4GiB within a shared directory. #65478

Enterprise:

Fixed regresion where users added to an Okta group via SCIM were silently dropped when the Okta integration was configured in read-only mode with SCIM enabled.
SCIM-synced access lists will now have a badge displayed next to them in the web UI.
Fixed a bug that could cause panics in Teleport's SAML IdP during failure scenarios.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Plugins

Download the current release of Teleport plugins from the links below.

Slack Linux amd64 | Linux arm64
Mattermost Linux amd64 | Linux arm64
Discord Linux amd64 | Linux arm64
Terraform Provider Linux amd64 | Linux arm64 | macOS amd64 | macOS arm64 | macOS universal
Event Handler Linux amd64 | Linux arm64 | macOS amd64
PagerDuty Linux amd64 | Linux arm64
Jira Linux amd64 | Linux arm64
Email Linux amd64 | Linux arm64
Microsoft Teams Linux amd64 | Linux arm64

Security Fixes

Tightened signature handling in Device Trust challenge/response validation — enhances security posture

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track teleport

Get notified when new releases ship.

About teleport

The easiest, and most secure way to access and protect all of your infrastructure.

All releases →

Related context

Related tools

Earlier breaking changes

v18.10.0 Kubernetes ephemeral container addition now requires both exec and patch/update verbs.
v18.8.0 Roles with unknown fields rejected at create/edit instead of silently dropped.
v18.8.0 Teleport Connect automatic updates only; manual downgrades required.