v16.5.13

gravitational/teleportv16.5.13Jul 3, 2025by fheinecke

AI Summary

This release addresses a critical security vulnerability (CVE-2025-49825) that allowed remote SSH authentication bypass on servers with Teleport SSH agents, OpenSSH-integrated deployments, and Teleport Git proxy deployments. The patch removes special handling for SSH Certificate authorities in the certificate validation callbacks. Additionally, this release includes numerous bug fixes across Windows desktop services, Kubernetes access, hardware key support, and the tbot client, along with a Go update to 1.23.10.

Key Highlights

Critical security fix for remote SSH authentication bypass (CVE-2025-49825) affecting Teleport SSH agents, OpenSSH-integrated, and Git proxy deployments
Added trait role templating support in the workload_identity_labels Role resource field
Fixed memory leak in Kubernetes Access caused by resources not being cleaned up when clients terminate watch streams
Resolved Windows desktop session termination issues when idle timeout was exceeded
Updated Go to 1.23.10 and fixed Hardware Key Support for YubiKey firmware versions 5.7.x

New Features

Trait role templating support in workload_identity_labels Role resource field
New teleport-update status --is-up-to-date flag to change return code based on update status
WindowsDesktop and WindowsDesktopService APIs now use pagination to avoid message size limitations
tbot client now ensures O_CLOEXEC flag is used when opening files on Linux hosts

Full Release Notes

## Description

### Security fixes

This release also includes fixes for the following security issues:

#### [Critical] Remote authentication bypass

* Removed special handling for `*ssh.Certificate` authorities in the `IsHostAuthority` and `IsUserAuthority` callbacks used by `x/crypto/ssh.CertChecker`. [#56253](https://github.com/gravitational/teleport/pull/56253)

Resolved an issue that allowed remote SSH authentication bypass on servers with Teleport SSH agents, OpenSSH-integrated deployments and Teleport Git proxy deployments.  [CVE-2025-49825](https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc). Refer to the [RCA](https://trust.goteleport.com/resources?s=32t147ja8aawd6px7irxat&name=cve-2025-49825-rca) for the full details.

### Other fixes and improvements

* Trait role templating is now supported in the `workload_identity_labels` Role resource field. [#56298](https://github.com/gravitational/teleport/pull/56298)
* Updated the WindowsDesktop and WindowsDesktopService APIs to use pagination to avoid exceeding message size limitations. [#56233](https://github.com/gravitational/teleport/pull/56233)
* Fixed duplicated entries in `tctl inventory list` when using DynamoDB as cluster state storage. [#56183](https://github.com/gravitational/teleport/pull/56183)
* Fixed an issue that could prevent Windows desktop sessions from terminating when the idle timeout was exceeded. [#56049](https://github.com/gravitational/teleport/pull/56049)
* Added the the `teleport-update status --is-up-to-date` flag to change the return code based on the update status. [#55951](https://github.com/gravitational/teleport/pull/55951)
* Fixed Hardware Key Support for YubiKey firmware versions 5.7.x. [#55902](https://github.com/gravitational/teleport/pull/55902)
* Fixed an error when creating or updating join tokens in the web UI when admin action is enabled (second_factor set to webauthn). [#55852](https://github.com/gravitational/teleport/pull/55852)
* Fixes a memory leak in Kubernetes Access caused by resources not being cleaned up when clients terminate watch streams. [#55768](https://github.com/gravitational/teleport/pull/55768)
* Fixed a bug that could cause Kubernetes exec requests to fail when the Kubernetes cluster had the WebSocket-based exec protocol disabled. [#55733](https://github.com/gravitational/teleport/pull/55733)
* Fixed an issue where the output from `tctl sso configure github` could not be used with `tctl create -f` in OSS Teleport. [#55728](https://github.com/gravitational/teleport/pull/55728)
* Fixed an issue that prevented changes to default shell from propagating for host users and static host users. [#55649](https://github.com/gravitational/teleport/pull/55649)
* Updated Go to 1.23.10. [#55603](https://github.com/gravitational/teleport/pull/55603)
* Fixed updating the default PIN and PUK for hardware key support in Teleport Connect. [#55509](https://github.com/gravitational/teleport/pull/55509)
* The `tbot` client now ensures the `O_CLOEXEC` flag is used when opening files on Linux hosts. [#55504](https://github.com/gravitational/teleport/pull/55504)
## Download
Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v16.5.13-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v16.5.13-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v16.5.13-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.13-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.13-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.13-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v16.5.13-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v16.5.13-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v16.5.13-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v16.5.13-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v16.5.13-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v16.5.13-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v16.5.13-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v16.5.13-linux-arm64-bin.tar.gz)

---

labels: security-patch=yes,security-patch-alts=v16.5.12