Starstruk Logo MarkStarstruk

v18.2.0

gravitational/teleportv18.2.0Sep 5, 2025by fheinecke

AI Summary

Teleport v18.2.0 introduces significant security and usability enhancements including encrypted session recordings with HSM support, AI-powered session summaries for Identity Security users, and a redesigned recordings page with thumbnails. This release also adds Intune integration for Device Trust, Terraform support for Access List members, MySQL web terminal, and AlloyDB database support.

Key Highlights

  • Encrypted session recordings with Hardware Security Module (HSM) integration for data-at-rest encryption
  • AI session summaries for SSH, Kubernetes, and database sessions in Teleport Identity Security
  • Teleport Connect now supports automatic managed updates on restart
  • Microsoft Intune integration for syncing trusted devices into Teleport Device Trust
  • New session recordings UI with thumbnails, interactive timeline, and enhanced filtering options

Breaking Changes

  • Entra ID OIDC groups overage claim requires OIDC connector configuration update to request `profile` scope and grant `User.ReadBasic.All` Graph API permission to the enterprise application in Entra ID

New Features

  • Encrypted session recordings at rest with HSM support
  • AI-generated session summaries for SSH, Kubernetes, and database sessions
  • Session recordings page redesign with thumbnails and summaries
  • Teleport Connect managed auto-updates
  • Microsoft Intune integration for Device Trust
  • Terraform support for Access List members including nested Access Lists
  • Long-term vs short-term access request differentiation in web UI
  • MySQL database web terminal in Teleport web UI
  • GCP AlloyDB database access support
  • Database health check metrics (healthy, unhealthy, unknown states)
  • Interactive timeline for session recordings navigation
  • Enhanced session recordings RBAC based on creator's roles, traits, and resource properties
  • SCIM Plugin configuration support for OIDC and GitHub connectors
  • MySQL session start audit events with user_agent field
  • tbot kubernetes service default namespace configuration
  • Contiguous shared directory read/write event compaction in audit logs
  • SSH SELinux module management in teleport-update

Full Release Notes

## Description

### Encrypted session recordings

Teleport now provides the ability to integrate with Hardware Security Modules (HSMs) in order to encrypt session recordings prior to uploading them to storage.

### AI session summaries

Teleport Identity Security users are now able to view AI-generated summaries for SSH, Kubernetes and database sessions.

### Updated session recordings page

Session recordings page in Teleport web UI are now updated with a new design that will include session thumbnails and ability to view session summaries for Identity Security users.

### Teleport Connect Managed Updates

Teleport Connect is now able to detect when application updates are available and automatically apply them on the next restart.

### Teleport Device Trust Intune Support

Teleport now includes a new hosted plugin for Microsoft's Intune suite, allowing trusted devices to be synchronized from the Intune inventory.

### Terraform support for Access List members

Users are now able to provision Access Lists and their members (including other nested Access Lists) with terraform.

### Long-term access requests UX

Teleport access requests creation dialog in web UI now better differentiate between short and long-term access requests.

### Database web terminal for MySQL

Teleport web UI now provides terminal interface for MySQL database access.

### Database access for AlloyDB

Teleport now supports database access for GCP AlloyDB databases.

### Other changes and improvements

* Improved observability by adding health check metrics for healthy, unhealthy, and unknown states. Database health checks can now be monitored with these metrics. [#58708](https://github.com/gravitational/teleport/pull/58708)
* New session recordings now display an interactive timeline for faster navigation. [#58671](https://github.com/gravitational/teleport/pull/58671)
* Removed AccessList review notification check from tsh login/status flow. [#58662](https://github.com/gravitational/teleport/pull/58662)
* Lock, unlock and delete from the Bot Details page, as well as viewing lock status. [#58653](https://github.com/gravitational/teleport/pull/58653)
* Fixed internal access list membership caching issue that caused high CPU usage when the total number of members exceeded 200. [#58614](https://github.com/gravitational/teleport/pull/58614)
* Fix internal cache issue that could cause crashes in AWS IC, Database, and App access flows. [#58611](https://github.com/gravitational/teleport/pull/58611)
* Fixed panic in `tbot`'s `ssh-multiplexer` service. [#58595](https://github.com/gravitational/teleport/pull/58595)
* Teleport now honours Entra ID OIDC groups overage claim. The OIDC connector spec in Teleport must be updated to request OIDC `profile` scope and the enterprise application in Entra ID must be granted with `User.ReadBasic.All` Graph API permission for this feature to work. By default, Teleport will query the Microsoft Graph API `graph.microsoft.com` endpoint and filter user's group membership of "security groups" group type. This behaviour can be updated by configuring `entra_id_groups_provider` configuration field, which is available in the OIDC connector configuration spec. [#58593](https://github.com/gravitational/teleport/pull/58593)
* Enhanced session recordings RBAC to enforce recording access based on rules that reference creator’s roles, traits, and resource properties. [#58563](https://github.com/gravitational/teleport/pull/58563)
* Added support for configure SCIM Plugin with OIDC or Github Teleport Connectors. [#58554](https://github.com/gravitational/teleport/pull/58554)
* Added user_agent field to MySQL database session start audit events. [#58523](https://github.com/gravitational/teleport/pull/58523)
* `tbot` now supports the configuration of a default namespace for kubeconfig files generated by the `kubernetes/v2` service. [#58494](https://github.com/gravitational/teleport/pull/58494)
* Reduced audit log clutter by compacting contiguous shared directory read/write events into a single audit log event. [#58446](https://github.com/gravitational/teleport/pull/58446)
* Session metadata now appears next to SSH sessions in the UI. [#58405](https://github.com/gravitational/teleport/pull/58405)
* Refreshed the list session recordings UI with thumbnails, more filtering options and a card/list view. [#58390](https://github.com/gravitational/teleport/pull/58390)
* Added thumbnail and metadata generation for session recordings. [#58360](https://github.com/gravitational/teleport/pull/58360)
* Teleport Connect now supports managed updates. [#58260](https://github.com/gravitational/teleport/pull/58260)
* Teleport Connect now brings focus back from the browser to itself after a successful SSO login. [#58260](https://github.com/gravitational/teleport/pull/58260)
* Added support for GCP AlloyDB. [#58202](https://github.com/gravitational/teleport/pull/58202)
* Added Microsoft Intune integration for syncing devices into Teleport Device Trust. [#57986](https://github.com/gravitational/teleport/pull/57986)
* Added support for encrypting session recordings at rest across all recording modes. Encryption can be enabled statically by setting `auth_server.session_recording_config.enabled: yes` in the Teleport file configuration, or dynamically by editing the `session_recording_config` resource and setting `spec.encryption.enabled: yes`. [#57959](https://github.com/gravitational/teleport/pull/57959)
* Added a MySQL database client REPL to the Teleport web UI. [#57798](https://github.com/gravitational/teleport/pull/57798)
* Added SSH SELinux module management to teleport-update. [#57660](https://github.com/gravitational/teleport/pull/57660)
* Added Terraform support for Access List members. [#57058](https://github.com/gravitational/teleport/pull/57058)


## Download
Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.2.0-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.2.0-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.2.0-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.2.0-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.2.0-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.2.0-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.2.0-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.2.0-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.2.0-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.2.0-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.2.0-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.2.0-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.2.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.2.0-linux-arm64-bin.tar.gz)