v18.4.1
gravitational/teleportv18.4.1Nov 20, 2025by doggydogworld
AI Summary
Feature release adding scoped tokens support, audit log improvements, and enterprise features including Jamf API updates.
Key Highlights
- Added support for scoped tokens using tctl (SSH nodes can join within particular scope)
- Fixed audit log search in web UI with Athena storage
- Added caches for AD user SID lookups and TLS certificate requests
- Fixed web upload/download behind load balancers
- Enterprise: Added support for Jamf v2 API
- Enterprise: Added audit events for SCIM provisioning requests
- Enterprise: AWS Identity Center resource synchronizer improvements
New Features
- Scoped tokens support
- Audit log improvements
- Enterprise integration updates
Full Release Notes
## Description * Fixed a bug that prevented searching audit log events in the web UI when using Athena audit storage. [#61603](https://github.com/gravitational/teleport/pull/61603) * Prevented Trivy from reporting false positives when scanning the Teleport binaries. [#61539](https://github.com/gravitational/teleport/pull/61539) * Added support for `tsh logout --proxy` (or `TELEPORT_PROXY` set) to work without `--user` flag when one identity exists. [#61404](https://github.com/gravitational/teleport/pull/61404) * Fixed web upload/download failure behind load balancers when web listen address is unspecified. [#61393](https://github.com/gravitational/teleport/pull/61393) * Fixed corrupted private keys breaking tsh. [#61388](https://github.com/gravitational/teleport/pull/61388) * Resource names are now properly validated for AWS Roles Anywhere integration `Generate Command`. [#61385](https://github.com/gravitational/teleport/pull/61385) * Added caches to reduce Active Directory user SID lookups and TLS certificate requests. [#61317](https://github.com/gravitational/teleport/pull/61317) * GOAWAY errors received from Kubernetes API Servers configured with a non-zero --goaway-chance are now forward to clients to be retried. [#61256](https://github.com/gravitational/teleport/pull/61256) * Added support for creating and managing scoped tokens using `tctl scoped tokens add/ls/rm`. SSH nodes can now join a cluster within a particular scope by joining with a scoped token. [#60758](https://github.com/gravitational/teleport/pull/60758) Enterprise: * Removed sync of the model identifier from Intune to avoid mismatches between the identifier reported by Intune vs Teleport clients. * Added support for Jamf's /v2/computers-inventory API (addresses Jamf's deprecation of /v1/computers-inventory). * Updated the AWS Identity Center resource synchronizer to handle AWS Account name changes more gracefully. * Added audit events in response to SCIM provisioning requests. ## Download Download the current and previous releases of Teleport at https://goteleport.com/download. ## Plugins Download the current release of Teleport plugins from the links below. * Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.4.1-linux-arm64-bin.tar.gz) * Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.4.1-linux-arm64-bin.tar.gz) * Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.4.1-linux-arm64-bin.tar.gz) * Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.4.1-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.4.1-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.4.1-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.4.1-darwin-universal-bin.tar.gz) * Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.4.1-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.4.1-darwin-amd64-bin.tar.gz) * PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.4.1-linux-arm64-bin.tar.gz) * Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.4.1-linux-arm64-bin.tar.gz) * Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.4.1-linux-arm64-bin.tar.gz) * Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.4.1-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.4.1-linux-arm64-bin.tar.gz)