v17.7.26
gravitational/teleportv17.7.26Jun 23, 2026by r0mant
AI Summary
A patch release for version 17.7 that introduces a breaking change regarding Kubernetes API server proxy authorization and includes several security and bug fixes.
Key Highlights
- Kubernetes API server proxy access now requires the `proxy` verb in `kubernetes_resources`.
- Fixed SSRF vulnerability in AWS application access.
- Fixed file upload issues involving path separators in filenames.
- Updated golang.org/x/crypto to v0.53.0.
Breaking Changes
- Access to the Kubernetes API server proxy endpoints (`pods/{name}/proxy/{path}`, `services/{name}/proxy/{path}`, `nodes/{name}/proxy/{path}`) now requires the `proxy` verb in `kubernetes_resources` instead of being authorized as `get`.
Full Release Notes
## Description
### Breaking changes
#### Kubernetes API server proxy access
Access to the Kubernetes API server `pods/{name}/proxy/{path}`,
`services/{name}/proxy/{path}`, and `nodes/{name}/proxy/{path}`
endpoints now requires the new `proxy` verb in `kubernetes_resources`.
Previously these endpoints were authorized as the `get` verb. Roles
that use the Kubernetes API server proxy must add `"proxy"` to the
relevant `verbs` list.
### Other fixes and improvements
* Fixed Teleport Connect file uploads for empty files. [#67926](https://github.com/gravitational/teleport/pull/67926)
* Fixed an issue where path separators could be included in scp file names during upload. [#67773](https://github.com/gravitational/teleport/pull/67773)
* Sanitized AWS console federation transport errors to avoid logging AWS session credential material. [#67708](https://github.com/gravitational/teleport/pull/67708)
* Fixed an SSRF vulnerability in AWS application access where a crafted X-Forwarded-Host header could divert IAM-signed AWS API requests to an attacker-controlled host. [#67707](https://github.com/gravitational/teleport/pull/67707)
* Cap AWS STS AssumeRole session duration to the Teleport identity TTL, including query-string AssumeRole requests and requests made with cached assumed-role credentials. [#67705](https://github.com/gravitational/teleport/pull/67705)
* Fixed role impersonation incorrectly being affected by user allow/deny rules. [#67690](https://github.com/gravitational/teleport/pull/67690)
* Prevented users with the same name in different clusters from being able to cancel each others' remote port forwards. [#67688](https://github.com/gravitational/teleport/pull/67688)
* Update golang.org/x/crypto to v0.53.0. [#67641](https://github.com/gravitational/teleport/pull/67641)
## Download
Download the current and previous releases of Teleport at https://goteleport.com/download.
## Plugins
Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v17.7.26-linux-arm64-bin.tar.gz)
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v17.7.26-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v17.7.26-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v17.7.26-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v17.7.26-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v17.7.26-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v17.7.26-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v17.7.26-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.26-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v17.7.26-linux-arm64-bin.tar.gz)