Starstruk Logo MarkStarstruk

v17.7.26

agentscope-ai/QwenPawv17.7.26Jun 23, 2026by r0mant

AI Summary

This is a Teleport release (not from agentscope-ai/QwenPaw) introducing a breaking change to Kubernetes API server proxy access and fixing various security vulnerabilities and file upload issues.

Key Highlights

  • Breaking change: Kubernetes API proxy endpoints now require 'proxy' verb in kubernetes_resources
  • Fixed SSRF vulnerability in AWS application access via crafted X-Forwarded-Host headers
  • Fixed Teleport Connect file uploads for empty files
  • Fixed path separators included in scp file names during upload
  • Fixed role impersonation being incorrectly affected by user allow/deny rules

Breaking Changes

  • Access to Kubernetes API server proxy endpoints (pods, services, nodes) now requires the 'proxy' verb in kubernetes_resources list

Full Release Notes

## Description

### Breaking changes

#### Kubernetes API server proxy access

Access to the Kubernetes API server `pods/{name}/proxy/{path}`,
`services/{name}/proxy/{path}`, and `nodes/{name}/proxy/{path}`
endpoints now requires the new `proxy` verb in `kubernetes_resources`.
Previously these endpoints were authorized as the `get` verb. Roles
that use the Kubernetes API server proxy must add `"proxy"` to the
relevant `verbs` list.

### Other fixes and improvements

* Fixed Teleport Connect file uploads for empty files. [#67926](https://github.com/gravitational/teleport/pull/67926)
* Fixed an issue where path separators could be included in scp file names during upload. [#67773](https://github.com/gravitational/teleport/pull/67773)
* Sanitized AWS console federation transport errors to avoid logging AWS session credential material. [#67708](https://github.com/gravitational/teleport/pull/67708)
* Fixed an SSRF vulnerability in AWS application access where a crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to an attacker-controlled host. [#67707](https://github.com/gravitational/teleport/pull/67707)
* Cap AWS STS AssumeRole session duration to the Teleport identity TTL, including query-string AssumeRole requests and requests made with cached assumed-role credentials. [#67705](https://github.com/gravitational/teleport/pull/67705)
* Fixed role impersonation incorrectly being affected by user allow/deny rules. [#67690](https://github.com/gravitational/teleport/pull/67690)
* Prevented users with the same name in different clusters from being able to cancel each others' remote port forwards. [#67688](https://github.com/gravitational/teleport/pull/67688)
* Update golang.org/x/crypto to v0.53.0. [#67641](https://github.com/gravitational/teleport/pull/67641)

## Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.26-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.26-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.26-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.26-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.26-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.26-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.26-linux-arm64-bin.tar.gz)