Starstruk Logo MarkStarstruk

v18.9.2

agentscope-ai/QwenPawv18.9.2Jun 29, 2026by r0mant

AI Summary

This is a Teleport release (not from agentscope-ai/QwenPaw) that fixes certificate renewal issues, adds new commands for Sub CA overrides and app logins, and resolves multiple security and stability problems.

Key Highlights

  • Fixed HTTP 403 errors after certificate renewal by sending Connection: close header
  • Added 'tsh apps logins' command to query cloud application logins (AWS)
  • Fixed Slack plugin exposing credentials in request URLs
  • Added 'tctl auth delete-override' and 'tctl auth create-override' commands for Sub CA
  • Fixed desktop connection failures to Windows 11/Server 2025 instances

New Features

  • Sub CA override commands for user-friendly CA management
  • tsh apps logins command for querying application logins
  • Rate limiting support in Teleport SCIM Server
  • Entra ID integration delta sync support

Full Release Notes

## Description

* Fixed HTTP application access connections returning repeated 403 errors after certificate renewal. When the certificate behind a long-lived connection expires, the proxy now sends `Connection: close` so the client reestablishes the connection with a renewed certificate instead of reusing a dead one. [#68099](https://github.com/gravitational/teleport/pull/68099)
* Add "tsh apps logins" command to query available logins for the given cloud application (currently only AWS is supported). [#68052](https://github.com/gravitational/teleport/pull/68052)
* Fixed cloud-hosted Slack plugin exposing credentials in request URLs. [#68017](https://github.com/gravitational/teleport/pull/68017)
* Added the Sub CA `tctl auth delete-override` command, a user-friendly alternative over `tctl edit ca_overrides` or `tctl rm ca_overrides`. [#68014](https://github.com/gravitational/teleport/pull/68014)
* Fixed potential deadlock when reading access list owners from the cache as the cache becomes unhealthy. [#68013](https://github.com/gravitational/teleport/pull/68013)
* Added the Sub CA `tctl auth create-override` command, a user-friendly alternative over `tctl create ca_override.yaml`. [#67983](https://github.com/gravitational/teleport/pull/67983)
* Fix MFA prompts to show correct --mfa-mode values for webauthn authenticators. [#67971](https://github.com/gravitational/teleport/pull/67971)
* Prevent misrouting when multiple apps share the same public address. [#67947](https://github.com/gravitational/teleport/pull/67947)
* Fix an issue where the WebUI would prompt for MFA multiple times for admin actions (or outright fail for select commands) when `sso` is the only allowed second factor on the cluster. [#67867](https://github.com/gravitational/teleport/pull/67867)
* Fixed desktop connection failures to Windows 11 / Windows Server 2025 instances. [#67483](https://github.com/gravitational/teleport/pull/67483)

Enterprise:

* Add support for rate limiting in the Teleport SCIM Server.
* Update `golang.org/x/crypto` to `v0.53.0`.
* Updated Teleport Entra ID integration to support delta sync.
* Only process Okta assignments for groups and apps currently being synced.
* Prevent user-deletion of Access Lists being synced by Okta integration.

## Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.9.2-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.9.2-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.9.2-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.9.2-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.9.2-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.9.2-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.9.2-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.9.2-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.9.2-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.9.2-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.9.2-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.9.2-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.9.2-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.9.2-linux-arm64-bin.tar.gz)