v16.5.11

gravitational/teleportv16.5.11Jun 5, 2025by camscale

AI Summary

This is a security patch release for Teleport v16.5.11 addressing two security vulnerabilities: a high-severity access escalation issue in Okta integration where users with just-in-time access could be unintentionally promoted to access lists, and a medium-severity PKINIT/Kerberos vulnerability allowing file overwrite on SQL Server systems. The release also includes several bug fixes for the web UI, Prometheus metrics, tctl commands, Hardware Key Support on Windows, database listing, and OpenSearch discovery.

Key Highlights

[High] Fixed Okta integration access escalation where users with just-in-time access requests could be unintentionally promoted to access list grants
[Medium] Fixed PKINIT/Kerberos vulnerability allowing users to overwrite host files on SQL Server database systems
Fixed unknown resource kinds causing rendering errors in the web UI
Fixed Hardware Key Support on Windows PIN prompt timeout issue (5 second limit)
Fixed database discovery failing when there are more than 5 OpenSearch domains

Full Release Notes

## Description

### Security fixes

This patch includes some security fixes.
These issues are present in previous v16 releases.
Impacted users are recommended to upgrade their auth and proxy servers to the latest version.

#### [High] Short to long term access escalation in Okta integration

* Enterprise fix: Verify required Okta OAuth scopes during plugin creation/update.

In Okta integration configurations with enabled access lists sync, a user with an approved  just-in-time access request to an Okta application could be unintentionally promoted to an access list granting access to the same application. This would result in the access to the Okta app/group persisting after the access request expiration.

This vulnerability affects Okta integration users who have access lists sync enabled. You can check whether you have an Okta integration installed with access lists sync enabled either in the Teleport web UI under Zero Trust Access / Integrations page or by running “tctl get plugins/okta” CLI command and looking at the “spec.settings.okta.sync_settings.sync_access_lists” flag.

#### [Medium] Unsanitized user input affecting PKINIT (Kerberos)

* Fixed users being able to overwrite host files on SQL Server database systems when using Kerberos with PKINIT flow. [#55143](https://github.com/gravitational/teleport/pull/55143)

### Other fixes and improvements

* Fixed unknown resource kinds from rendering errors in the web UI. [#55210](https://github.com/gravitational/teleport/pull/55210)
* Fixed the formatting of the `cache_component` label for the Prometheus metrics `teleport_cache_health` and `teleport_cache_last_reset_seconds`. [#55192](https://github.com/gravitational/teleport/pull/55192)
* Fixed `tctl` rendering of timestamps in BotInstance resource YAML. [#55164](https://github.com/gravitational/teleport/pull/55164)
* Fixed an issue with Hardware Key Support on Windows where a command would fail if the PIN prompt was not answered within 5 seconds. [#55109](https://github.com/gravitational/teleport/pull/55109)
* Fixed an issue where the &#34;Allowed Users&#34; field from &#34;tsh db ls&#34; may include irrelevant entities. [#55069](https://github.com/gravitational/teleport/pull/55069)
* Fixed database discovery failing when there are more than 5 OpenSearch domains. [#55059](https://github.com/gravitational/teleport/pull/55059)

## Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v16.5.11-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v16.5.11-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v16.5.11-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.11-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.11-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.11-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.11-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v16.5.11-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v16.5.11-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v16.5.11-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v16.5.11-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v16.5.11-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v16.5.11-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v16.5.11-linux-arm64-bin.tar.gz)

---

labels: security-patch=yes