teleport — The Cyber Toolchain

teleport v18.9.0

Thu, 18 Jun 2026 00:19:58 GMT

Teleport v18.9.0 adds Device Bound Session Credentials for app access, Windows high-DPI desktops, and sub-CA support. • Application session cookies now support Google's Device Bound Session Credentials to protect against hijacking • Windows remote desktop sessions gain high-DPI mode for clearer display rendering • Teleport can operate as a sub-CA of an external root for Windows Desktop and Database Client CAs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.8.3

Fri, 05 Jun 2026 13:42:35 GMT

Adds `tsh workload-identity issue-jwt` command for JWT-SVID issuance and `identity/key-agent` service to tbot. • Introduced `tsh workload-identity issue-jwt` command for human issuance of JWT-SVIDs. • Added `identity/key-agent` service to enable `tbot` to generate un-exfiltratable credentials. • Added `web_terminal_clipboard_mode` role option to restrict copying text from a web terminal SSH session. Breaking changes: • The embedded session helper functionality is now disabled by default, requiring setting the `TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC` environment variable to `no` to enable it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.24

Tue, 02 Jun 2026 03:20:27 GMT

Teleport v17.7.24 raises app access upstream response-header cap to 1 hour for long-running requests. • Enterprise licenses with a devices limit for device trust can now enroll unlimited devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.8.2

Fri, 22 May 2026 17:35:34 GMT

Teleport v18.8.2 adds SCIM-synced access list badges in web UI and improves reliability of Okta assignments processing • SCIM-synced access lists now display a badge in the web UI to distinguish them from manually managed lists. • Okta assignments processing has been improved for greater reliability during synchronization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.8.1

Fri, 15 May 2026 21:23:14 GMT

Teleport v18.8.1 adds Kubernetes join service account targeting, extends app access headers, and improves UI error messaging • `kubernetes.join_method` allow rules now support `service_account_names` and `namespaces` with wildcard support for granular cluster joining control. • App access upstream response-header cap increased to 1 hour, enabling long-running HTTP requests through Teleport to complete successfully. • MFA prompts in `tsh` and Teleport Connect display the leaf cluster name for resources belonging to a leaf cluster. • Web app access via Device Trust now serves an HTML page (instead of plain text) when the browser originates from an untrusted device. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.8.0

Tue, 12 May 2026 15:02:20 GMT

Adds VNet for Linux, tsh MFA via browser, bound keypair joining for agents, and session summaries search. • Extends Teleport VNet support to Linux workstations • Delegates `tsh` MFA checks to the browser for passkey/password manager use • Adds `bound keypair` join method support for arbitrary Teleport agents • Enables natural language search of session summaries via new Identity Security CLI tooling • Supports RDP connections to Windows hosts in different Active Directory domains • Adds Terraform module support for AWS EKS discovery at the account level • Adds Terraform configuration generation for access list workflows in the web UI • Permits per-machine and per-user installation modes for Teleport Connect on Windows • Shows specific IAM roles available during AWS privilege escalation requests in Access Requests • Adds `tsh beams` subcommand for the Beams public beta • Extends `tctl discovery nodes` to include Azure VM resources for troubleshooting enrollment • Adds support for `WorkloadIdentity` with `--apply-on-startup` and `--bootstrap` flags in tbot • Introduces user traits filtering in the web UI Access List creation wizard Breaking changes: • Teleport Connect Windows now only supports automatic upgrades; downgrades must be performed manually. • The environment variables `TELEPORT_CDN_BASE_URL` and `TELEPORT_TOOLS_VERSION` are deprecated for Teleport Connect Windows updates; configure via system policy registry keys under `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER\SOFTWARE\Policies\Teleport\TeleportConnect`. • Automatic updates in Teleport Connect no longer allow app version downgrades (applies to all platforms). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.7.6

Thu, 30 Apr 2026 19:46:20 GMT

Teleport v18.7.6 adds scoped roles in Terraform/k8s operators, new CLI commands, and expanded SSH/scoped role capabilities. • Adds `tctl discovery nodes` command for troubleshooting AWS EC2 auto-discovery enrollment issues. • Adds `skip_initial_connection` option to the `teleportmwi` provider to allow lazy initialization of the provider. • Adds `ui_config` resource support to the Terraform provider. • Added current and previous resources discovered summary per service to Discovery Config Status. • Added `lock` resource support to the Kubernetes operator. • Added scoped role assignment support to the Terraform provider. • Added scoped roles support to the Terraform provider. • Added scoped role assignments to the k8s operator. • Added scoped role to the k8s operator. • Added `teleport_app_active_sessions` Prometheus gauge with `app` label for app access agent autoscaling. • Added support for Azure join tokens based on Azure tenant ID. • Added `user.metadata.name` variable to RBAC role templates and expressions. • Add x11 forwarding, SSH File Copying, Agent Forwarding, SSH Port Forwarding, Create Host User, Max Sessions, and host sudoers to scoped ssh role options. • Standard Teleport agents can now join using the `bound_keypair` join method. • Add support for `*` and `$` globbing to the GitHub Actions token rules. • Extended access monitoring predicate language with contains(set, item) expression. • Added visible `teleport.dev/` labels for Azure and GCP auto-discovered VMs. • Add SAML IdP Service Provider support to Terraform provider. Breaking changes: • Auth connector names are now limited to 768 characters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.23

Thu, 30 Apr 2026 15:25:29 GMT

Adds `teleport_app_active_sessions` Prometheus gauge with app label for autoscaling insights. • Add `teleport_app_active_sessions` Prometheus gauge with `app` label for app access agent autoscaling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.20

Fri, 06 Mar 2026 23:09:50 GMT

Adds `tctl recordings download` subcommand to fetch session recordings locally without backend access. • Added `tctl recordings download` command to download session recordings to local files without requiring direct access to the storage backend. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.7.2

Fri, 06 Mar 2026 21:36:36 GMT

v18.7.2 adds `TeleportAccessMonitoringRuleV1` and session summarizer support to the Kubernetes operator, plus scoped token updates to tctl. • Adds update scoped token support to `tctl` and removes the status requirement from the upsert scoped token RPC • Adds `scoped` tokens to `tctl` resource commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.7.1

Wed, 25 Feb 2026 16:40:04 GMT

Teleport v18.7.1 adds UpsertScopedToken RPC and platform info for EC2 discovery. • `server side secret obfuscating` is enabled for `GetScopedTokens` RPC • New `UpsertScopedToken` RPC is available • `ssm.run` events now include `platform information` when auto discovering EC2 instances Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.7.0

Tue, 17 Feb 2026 23:03:36 GMT

Teleport v18.7.0 adds inventory UI, `tctl recordings download`, AWS org-level EC2 auto-discovery, and more. • `tsh status` gains a `--client` flag to skip server-side operations in client-only mode • Adds the `tctl recordings download` subcommand to download session recordings without backend access • AWS EC2 auto-discovery now supports organization-level enrollment from all or subset of accounts • New `discovery_config.static_labels` field allows static labels for LDAP-discovered Windows desktops • `tsh kubectl` tracing enabled via the `--trace` flag • `tbot start` supports the new `no-op` subcommand to start no services • Inventory UI shows complete inventory of all connected instances and bots • Entra ID integration status page available in the web UI • Managed Updates dashboard added to the WebUI for configuration and rollout monitoring Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.8

Tue, 10 Feb 2026 23:21:13 GMT

tsh proxy kube now supports custom command execution via --exec-cmd and --exec-arg flags • Adds `--exec-cmd` and `--exec-arg` flags to `tsh proxy kube` to allow launching custom commands like k9s directly without requiring environment variable workarounds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.18

Tue, 10 Feb 2026 04:52:44 GMT

Teleport v17.7.18 adds Access Monitoring for Cloud External Audit Storage and extends macOS support. • Extends `Access Monitoring` feature to Teleport Cloud customers using External Audit Storage. • Adds recording and validation for fixed OS login user values from `tsh` in Access Monitoring. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.7

Mon, 09 Feb 2026 22:54:01 GMT

Teleport v18.6.7 adds cert-manager support for event-handler Helm chart • Requires minimum macOS 12 (Monterey) for Teleport client tools and Teleport Connect • Modifies default `token` value in `tbot` helm chart to simplify deployment Breaking changes: • The minimum macOS version is raised to 12 (Monterey); clients on earlier versions will no longer function. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.6

Tue, 03 Feb 2026 06:30:35 GMT

Adds Helm chart support to `teleport-event-handler configure` and `tctl` resource removal for `okta_assignment`. • `teleport-event-handler configure` now supports generating or managing Helm charts. • `tctl` adds ability to remove `okta_assignment` internal resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.16

Tue, 03 Feb 2026 00:20:51 GMT

Teleport v17.7.16 adds multi-arch lock file support in the Terraform provider. • Adds multi-arch lock file population support for the Terraform provider Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.5

Thu, 29 Jan 2026 21:14:35 GMT

New `tctl alerts rm` command, tbot SPIFFE DaemonSet chart, and MCP ID token injection • Added the `tctl alerts rm ` command to delete specific cluster alerts. • Added support for injecting Teleport-issued ID tokens into outgoing MCP requests for OAuth/OIDC validation. • Introduced the `tbot-spiffe-daemon-set` Helm chart for deploying tbot agents via SPIFFE Workload API in Kubernetes. • Added the `--pid-file` flag to the `tbot systemd install` command. • Added opt-in support to bootstrap the `teleport-plugin-event-handler` Helm chart with Multi-Cluster Instance (MWI) auto-join capabilities. • Exported `additional_trusted_keys` in `tctl auth export` and the `/webapi/auth/export` endpoint to include certificates from the "init" rotation phase. • Implemented `tctl get cert_authority/catype` subcommand alongside existing certificate authority retrieval commands. • Added a Terraform module to configure Teleport and AWS for EC2 discovery in an AWS account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.15

Tue, 27 Jan 2026 19:29:53 GMT

Adds --pid-file flag to `tbot systemd install` command for custom PID file paths. • The `tbot systemd install` command now supports a `--pid-file` flag for setting the path to the PID file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.4

Wed, 21 Jan 2026 15:49:31 GMT

Teleport v18.6.4 adds `tbot wait` API, `teleport debug` commands, and AWS Console URL support • Adds `tbot wait` API and helper to let scripts wait for bots to become ready • Adds `teleport debug metrics` command • Adds `teleport debug readyz` command • Add `quicksight.aws.amazon.com` as valid URL for AWS Console access • Made the `teleport-cluster` Helm chart job resources configurable again via the `jobResources` value • Added automatic client certificate reloading option for postgres backends Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.13

Thu, 08 Jan 2026 21:24:22 GMT

Teleport v17.7.13 adds support for new AWS regions in IAM joining and respects region field in external audit storage configuration. • Adds IAM joining support from new AWS regions in asia Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.6.0

Tue, 23 Dec 2025 01:44:05 GMT

Teleport v18.6.0 adds Identifier-first login enhancements, GitHub Actions Kubernetes Wizard, and auth backoff config. • Adds `auth_connection_config` global configuration section to control Proxy/Agent backoff behavior • Adds `teleport-plugin-event-handler` Helm chart `annotations` support • Adds `extraArgs`, `extraEnv`, and `extraLabels` patterns to the `teleport-plugin-event-handler` Helm chart • Adds full environment variable configuration for the event handler CLI Breaking changes: • The default Managed Updates v2 update group is corrected to 'default' from 'stable/cloud' Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.5.1

Fri, 12 Dec 2025 21:59:39 GMT

Adds --format flag to `tsh request search`, Terraform support for `teleport_integration` and DiscoveryConfig resources, and `tsh recording ls` CLI • Added Terraform provider support for teleport_integration resources • DiscoveryConfig resources can now be managed via the Teleport Terraform Provider • Added support for listing application session recordings in `tsh recording ls` and the Web UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.11

Tue, 09 Dec 2025 00:00:50 GMT

Adds `tctl` ability to update existing Azure OIDC integrations and a new Workload Identities UI page. • Adds ability to update existing Azure OIDC integration with `tctl` • Adds a Workload Identities page to the web UI to list workload identities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.5.0

Thu, 04 Dec 2025 22:32:16 GMT

Teleport v18.5.0 adds Kubernetes relay support, SCIM PATCH, and improved EC2 discovery • Adds Kubernetes connectivity support to the Relay Service, allowing it to facilitate connections to Kubernetes clusters. • Introduces `SCIM PATCH` operations for SailPoint integrations, improving reliability of bulk identity synchronization via the Teleport SCIM server. • Enables discovery of EC2 instances in all regions without requiring enumeration, utilizing the `account.ListRegions` IAM permission. • Allows Azure resource discovery to authenticate using Azure OIDC integrations instead of traditional credentials. • Configures `GOMEMLIMIT` to default to 90% of configured memory limits in `teleport-cluster`, `teleport-kube-agent`, and `teleport-relay` Helm charts to reduce OOM-Killed risk. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.4.2

Mon, 01 Dec 2025 22:54:08 GMT

Adds --roles flag to tsh request search, User Details view in Web UI, and Azure OIDC update via tctl • Adds `--roles` flag for `tsh request search`, allowing users to list all requestable roles. • Added ability to update existing Azure OIDC integration with `tctl`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.4.1

Thu, 20 Nov 2025 22:09:38 GMT

Adds `tctl scoped tokens` commands and scoped cluster join support for SSH nodes in v18.4.1 • Adds `tctl scoped tokens add`, `ls`, and `rm` subcommands to create, list, and remove scoped tokens. • Enables SSH nodes to join a Teleport cluster within a particular scope using a scoped token. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.4.0

Fri, 14 Nov 2025 04:30:03 GMT

Teleport v18.4.0 adds MCP Zero-Trust HTTP transport, tsh scp cross-host support, env0 join method, and bot instance management improvements • `role.spec.allow.request.reason.prompt` allows configuring custom reason prompts for Access Requests per role/resource • New `env0` join method supports joining teleport instances within Env0 workflows • Supports MCP Zero-Trust Access over HTTP transport protocols in addition to stdio • Added a new OCI join method that does not require IAM policies • tbot now supports teleport-update for automated updates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.3.2

Fri, 07 Nov 2025 21:34:15 GMT

Teleport v18.3.2 adds Amazon Bedrock support for session recording summarizer in Enterprise edition. • Adds `Amazon Bedrock` as a backend for the session recording summarizer (Enterprise only). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.9

Thu, 06 Nov 2025 05:59:06 GMT

Adds `extraEnv` and `extraArgs` to teleport-operator Helm chart and editing bot descriptions in UI • Added editing bot description to the web UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.3.1

Wed, 05 Nov 2025 06:31:54 GMT

Adds `tsh mcp config/connect` custom headers, Windows Desktop KDC DNS discovery, and OIDC creds in tctl AWS Identity Center plugin • Adds support for custom HTTP headers in `tsh mcp config/connect` commands when connecting to streamable-HTTP MCP servers • Enables the Windows Desktop service to automatically discover the KDC server address via DNS lookup • Allows setting OIDC Integration credentials directly within the `tctl aws identity-center` plugin installer flow • Supports specifying `topologySpreadConstraints` in the teleport-kube-agent Helm chart for pod placement control • Enables summarization and metadata generation for encrypted session recordings, storing these assets in encrypted form Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.3.0

Thu, 30 Oct 2025 04:21:22 GMT

Adds Relay Service for SSH proxying, ElastiCache Serverless support, and Web UI Workload ID listing • Introduces the `teleport relay` service to act as a lightweight proxy for SSH connections, allowing clients and agents to bypass the control plane in large deployments. • Adds a Workload Identities page in the Web UI to list all workload identity resources registered in the cluster. • Enables continuous health monitoring of registered Kubernetes clusters with status display in the web UI and automatic routing to healthy services. • Allows multiple Teleport clusters to simultaneously discover the same EC2 instances via auto-discovery without interference. • Adds `time_between_imports` setting to Okta plugin configuration to control import frequency. • Adds support for regex conditions in AccessMonitoringRule policies. • Adds support for SSE and streamable-HTTP MCP servers in Teleport's capabilities. • Enables schedule configuration for Access Automation Rules directly within the Web UI. • Updates Entra ID plugin installation UI to support group filter configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.2.10

Fri, 24 Oct 2025 22:21:06 GMT

Teleport v18.2.10 adds `tbot start ssh-multiplexer`, bot description editing, and schedule support in access monitoring rules • Adds `tbot start ssh-multiplexer` subcommand to start the SSH multiplexer service without a config file • Enables use of schedules within automatic review and notification `access_monitoring_rules` • Adds `extraEnv` and `extraArgs` Helm chart values for `teleport-operator` • Adds PodSecurityContext support to the `tbot` Helm chart Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.8

Wed, 15 Oct 2025 20:26:41 GMT

Teleport v17.7.8 adds PodSecurityContext to tbot helm chart and a teleport_bot_instances metric • `tbot` helm chart now supports the `podSecurityContext` field • Adds the `teleport_bot_instances` metric for monitoring bot instances Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.2.4

Thu, 02 Oct 2025 03:27:39 GMT

Teleport v18.2.4 adds EC2/GCP/Azure server auto-discovery and Kubernetes recording context name templating • Added support for multiple agents in EC2, GCP and Azure Server auto discovery, allowing server access from different Teleport clusters • Added support for customizing context names with a template in `kubernetes/v2` output • Changed the event-handler plugin to skip over Windows desktop session recording events by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.2.3

Mon, 29 Sep 2025 23:37:52 GMT

Adds `tbot application-proxy` service and `copy-binaries` CLI; adds `@.iam` suffix for GCP Postgres usernames. • Introduces `application-proxy` service to `tbot` for HTTP proxying to applications protected by Teleport • Added `tctl tokens configure-kube` helper command to easily trust Kubernetes clusters and allow secure repeatable joining • Added tbot copy-binaries command to simplify using tbot as a Kubernetes sidecar • Added automatic `@.iam` suffix to GCP Postgres usernames (Teleport Connect) • Added support for generating VSCode and Claude Code MCP servers configurations to the `tsh mcp config` and `tsh mcp db config` commands • Allow controlling the description of auto-discovered Kubernetes apps with an annotation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.7

Mon, 29 Sep 2025 22:47:55 GMT

Adds `application-proxy` service to `tbot` for HTTP proxying to applications protected by Teleport. • Introduces `application-proxy` sub-service in `tbot` enabling HTTP proxying to applications protected by Teleport. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.5

Fri, 19 Sep 2025 04:42:45 GMT

Teleport v17.7.5 adds bound_keypair join method, tctl SCIM token updates, and multi-resource editing in tctl edit. • Adds `bound_keypair` as a new join method for Machine and Workload ID via the `spec.onboarding` resource field • Adds ability to update AWS Identity Center SCIM token using a new tctl subcommand • Enables editing multiple resources simultaneously in `tctl edit` when working with collections • Allows controlling description of auto-discovered Kubernetes apps via an annotation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v16.5.16

Fri, 19 Sep 2025 04:42:39 GMT

Teleport v16.5.16 adds install group config, fdpass binary, K8s app description annotation, and improved audit event details • Install script supports specifying a `--group` argument when installing agents with managed updates V2 enabled • New `fdpass-teleport` binary is now included in Teleport tar downloads for install scripts • Auto-discovered Kubernetes apps can be described using the `apps.gravitational.io/description` annotation • Windows Directory and Clipboard audit events now include the desktop name field Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.4

Tue, 09 Sep 2025 06:42:05 GMT

Adds default namespace support for tbot kubeconfig generation and SCIM plugin configuration with OIDC/GitHub connectors • Added `default_namespace` config option to `tbot` for controlling the Kubernetes namespace in generated kubeconfig files • Added Lock, unlock, and delete operations on the Bot Details page UI for managing bot lifecycle Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.2.0

Fri, 05 Sep 2025 15:44:03 GMT

Teleport v18.2.0 adds HSM-backed session recording encryption, GCP AlloyDB support, AI summaries, Terraform Access List provisioning, and Intune device sync. • Added `auth_server.session_recording_config.enabled: yes` in Teleport file configuration to enable static encryption of session recordings via HSMs • Added dynamic resource configuration via `session_recording_config` with `spec.encryption.enabled: yes` for runtime HSM-backed recording encryption • Added AI-generated summaries for SSH, Kubernetes, and database sessions in the web UI for Identity Security users • Added support for provisioning Access Lists and their members (including nested lists) via Terraform • Added hosted plugin for Microsoft Intune to synchronize trusted devices into Teleport Device Trust • Added MySQL database client REPL directly in the Teleport web UI terminal interface • Added database access support for GCP AlloyDB instances • Added `user_agent` field to MySQL database session start audit events • Added configuration of a default namespace for kubeconfig files generated by `tbot`'s `kubernetes/v2` service • Added enhanced RBAC rules for session recording access referencing creator’s roles, traits, and resource properties • Added support to configure SCIM Plugin with OIDC or Github Teleport Connectors • Added health check metrics for healthy, unhealthy, and unknown states for database monitoring • Added SSH SELinux module management capability in `teleport-update` Breaking changes: • Access List review notification check has been removed from the `tsh login/status` flow, changing the pre-login assessment state for users with pending access list reviews. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.3

Wed, 03 Sep 2025 02:50:02 GMT

tbot Kubernetes Secret destination now supports specifying a namespace; new `oidc` Kubernetes joining mode for delegated auth providers. • `tbot` Kubernetes Secret destinations can now specify a custom namespace via the `namespace` field in the secret configuration • Added `oidc` joining mode for Kubernetes delegated joining to support providers with public OIDC endpoints (e.g., EKS, AKS, GKE) • Support setting `"*"` in role `kubernetes_users` to match all users Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v16.5.15

Tue, 02 Sep 2025 22:26:52 GMT

Teleport v16.5.15 adds `tctl top` prometheus metrics view and Helm chart tbot credential support for event plugins. • Helm charts for `teleport-plugin-discord`, `teleport-plugin-email`, `teleport-plugin-jira`, `teleport-plugin-mattermost`, `teleport-plugin-msteams`, `teleport-plugin-pagerduty`, and `teleport-plugin-event-handler` now support obtaining plugin credentials using tbot. • Added `TELEPORT_UNSTABLE_GRPC_RECV_SIZE` environment variable to overwrite the client-side maximum gRPC message size. • Enabled Azure joining with VMSS for node registrations. • Windows desktop LDAP discovery now auto-populates the resource's description field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.8

Fri, 29 Aug 2025 22:15:23 GMT

Support for wildcard `*` in Kubernetes role `kubernetes_users` and Helm chart support for tbot plugin credentials • Allows setting `*` in role `kubernetes_users` to grant access to all users instead of listing them individually. • Helm charts for `teleport-plugin-discord`, `teleport-plugin-email`, `teleport-plugin-jira`, `teleport-plugin-mattermost`, `teleport-plugin-msteams`, `teleport-plugin-pagerduty`, and `teleport-plugin-event-handler` now support obtaining plugin credentials using tbot. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.7

Thu, 28 Aug 2025 03:43:55 GMT

tbot can now manage Argo CD clusters and specifies Kubernetes Secret namespace; OIDC connector gains separate request_object_mode • `tbot` `kubernetes/argo-cd` output service added for MWI to manage Argo CD clusters • Environment variable `TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS` allows re-enabling MySQL database health checks (disabled by default) • `request_object_mode` setting enabled for the MFA flow in OIDC connectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.6

Thu, 21 Aug 2025 02:45:03 GMT

Adds JWT-Secured Authorization to OIDC, Azure VMSS joining, gRPC size env var • `TELEPORT_UNSTABLE_GRPC_RECV_SIZE` environment variable allows overwriting client-side max gRPC message size. • Adds JWT-Secured Authorization Requests support to the OIDC Connector. • Enables Azure joining with Virtual Machine Scale Sets (VMSS). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v17.7.2

Wed, 20 Aug 2025 15:21:38 GMT

Teleport v17.7.2 adds JWT-Secured Authorization for OIDC, bot device modes, and CLI flags • Add `TELEPORT_UNSTABLE_GRPC_RECV_SIZE` env var to overwrite client-side max gRPC message size. • Add support for JWT-Secured Authorization Requests to the OIDC Connector. • Device Trust: added `required-for-humans` mode to enforce checks for human users while allowing bots on unenrolled devices. • Added the `--auth` flag to the `tctl plugins install scim` CLI command to support Bearer token and OAuth authentication methods. • Added `--force` option to `tctl workload-identity x509-issuer-overrides sign-csrs` to display output from partial failures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.5

Tue, 19 Aug 2025 00:08:40 GMT

New CockroachDB web/access support, `tctl plugins install scim` auth flag, Device Trust modes, and Kubernetes delegated joining. Adds `required-for-humans` mode to allow bots to run on unenrolled devices. • Adds `--auth` flag to `tctl plugins install scim` CLI command to support Bearer token and OAuth authentication methods • Enroll new Kubernetes agents in Managed Updates • Adds `TeleportDatabaseV3` support to the Teleport Kubernetes Operator • Adds `TeleportAppV3` support to the Teleport Kubernetes Operator • Allow the use of ResourceGroupsTaggingApi for KMS Key deletion • Tctl top can now display raw prometheus metrics • Enable resource label conditions for notification routing rules • Device Trust: added `required-for-humans` mode to allow bots to run on unenrolled devices, while enforcing checks for human users • Add new oidc joining mode for Kubernetes delegated joining to support providers that can be configured to provide public OIDC endpoints • Enrich the windows.desktop.session.start audit event with additional certificate metadata • Database MCP server now supports CockroachDB databases • Added support for CockroachDB Web Access and interactive CockroachDB session playback • Teleport `event-handler` now accepts HTTP Status Code 204 from the recipient Breaking changes: • Windows desktops cannot be connected to via the Web UI; downgrade proxy servers to 18.1.4, use Teleport Connect instead of the web UI to access desktops, or set your preferred keyboard layout (under account settings) to something other than _system_ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.3

Wed, 06 Aug 2025 05:10:07 GMT

Teleport v18.1.3 adds JSONPath query support for arbitrary JSON OIDC claims • Added support for consuming arbitrary JSON OIDC claims using the JSONPath query language. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport

teleport v18.1.2

Tue, 05 Aug 2025 20:33:13 GMT

Adds `Allowed Tools` to `tsh mcp ls` and configurable shutdown delay. • `tsh mcp ls` now lists Allowed Tools and warns if none are allowed. • Added configurable delay between receiving a termination signal and shutting down. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/teleport