Starstruk Logo MarkStarstruk

v18.10.0

silvia-odwyer/photonv18.10.0Jul 9, 2026by r0mant

AI Summary

This release introduces AI-powered session summaries and enhanced directory sharing for Windows desktop access. It also improves Kubernetes RBAC handling, adds new Sub CA management commands, and resolves several connectivity and security issues.

Key Highlights

  • AI summarization for Windows desktop access session recordings.
  • Support for sharing multiple directories in a single RDP session.
  • New `tctl auth update-override` and `delete-override` commands for Sub CA management.
  • Enhanced Kubernetes RBAC validation for wildcards and ephemeral containers.
  • Fixes for HTTP application access certificate renewal and MFA prompt issues.

New Features

  • AI summarization for Windows desktop access session recordings.
  • Directory sharing enhancements for Windows desktop access.
  • New `tsh apps logins` command to query available logins for cloud applications.
  • New `tctl auth update-override` and `delete-override` commands for Sub CA management.
  • Enterprise audit error events for all Sub CA RPC failures.

Full Release Notes

## Description

### Directory sharing enhancements for Windows desktop access

Teleport now supports sharing multiple directories in a single RDP session. In
addition, users will be able to unmount shared directories without terminating
the session.

### Windows sessions summaries

Identity Security now supports AI summarization for Windows desktop access
session recordings.

### Other fixes and improvements

* Resolve connectivity issues with the Redshift database through the MCP. [#68337](https://github.com/gravitational/teleport/pull/68337)
* Fixed premature session expiry for Application Access. [#68337](https://github.com/gravitational/teleport/pull/68357)
* Updated dependencies (addresses GO-2026-5547 and GO-2026-5694). [#68152](https://github.com/gravitational/teleport/pull/68152)
* Kubernetes resource RBAC now honors a wildcard (`*`) verb regardless of its position in the `verbs` list, including when introduced via trait templating. [#68143](https://github.com/gravitational/teleport/pull/68143)
* Added the Sub CA `tctl auth update-override` command, a user-friendly alternative over `tctl create -f` or `tctl edit ca_overrides`. [#68189](https://github.com/gravitational/teleport/pull/68189)
* Kubernetes: adding an ephemeral container to a pod (`pods/ephemeralcontainers`) now requires both the `exec` and `patch`/`update` verbs in the same role's `kubernetes_resources`. Previously only `patch`/`update` was required. [#68159](https://github.com/gravitational/teleport/pull/68159)
* Invalid role expressions are now rejected at creation time. [#67607](https://github.com/gravitational/teleport/pull/67607)
* Reject wildcards in role.allow.request.search_as_roles and role.allow.review_requests.preview_as_roles at creation time. [#67607](https://github.com/gravitational/teleport/pull/67607)
* Add missing validation for role.allow.require_session_join and role.allow.join_sessions fields. [#67607](https://github.com/gravitational/teleport/pull/67607)
* Improved the rate of Azure VM auto-discovery and enrollment. [#67941](https://github.com/gravitational/teleport/pull/67941)
* Fixed cloud-hosted Slack plugin exposing credentials in request URLs. [#68017](https://github.com/gravitational/teleport/pull/68017)
* Fix an issue where the WebUI would prompt for MFA multiple times for admin actions (or outright fail for select commands) when `sso` is the only allowed second factor on the cluster. [#67867](https://github.com/gravitational/teleport/pull/67867)
* Prevent misrouting when multiple apps share the same public address. [#67947](https://github.com/gravitational/teleport/pull/67947)
* Fix MFA prompts to show correct --mfa-mode values for webauthn authenticators. [#67971](https://github.com/gravitational/teleport/pull/67971)
* Fixed HTTP application access connections returning repeated 403 errors after certificate renewal. When the certificate behind a long-lived connection expires, the proxy now sends `Connection: close` so the client reestablishes the connection with a renewed certificate instead of reusing a dead one. [#68099](https://github.com/gravitational/teleport/pull/68099)
* Add "tsh apps logins" command to query available logins for the given cloud application (currently only AWS is supported). [#68052](https://github.com/gravitational/teleport/pull/68052)
* Added the Sub CA `tctl auth delete-override` command, a user-friendly alternative over `tctl edit ca_overrides` or `tctl rm ca_overrides`. [#68014](https://github.com/gravitational/teleport/pull/68014)

Enterprise:
* Changed Sub CA RPCs to emit audit error events for all failures.
* Fixed Access List review badge not appearing on the main page for users who are both an owner and a member of an Access List.

## Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

## Plugins

Download the current release of Teleport plugins from the links below.
* Slack [Linux amd64](https://cdn.teleport.dev/teleport-access-slack-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-slack-v18.10.0-linux-arm64-bin.tar.gz) 
* Mattermost [Linux amd64](https://cdn.teleport.dev/teleport-access-mattermost-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-mattermost-v18.10.0-linux-arm64-bin.tar.gz)
* Discord [Linux amd64](https://cdn.teleport.dev/teleport-access-discord-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-discord-v18.10.0-linux-arm64-bin.tar.gz)
* Terraform Provider [Linux amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.10.0-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/terraform-provider-teleport-v18.10.0-darwin-amd64-bin.tar.gz) | [macOS arm64](https://cdn.teleport.dev/terraform-provider-teleport-v18.10.0-darwin-arm64-bin.tar.gz) | [macOS universal](https://cdn.teleport.dev/terraform-provider-teleport-v18.10.0-darwin-universal-bin.tar.gz)
* Event Handler [Linux amd64](https://cdn.teleport.dev/teleport-event-handler-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-event-handler-v18.10.0-linux-arm64-bin.tar.gz) | [macOS amd64](https://cdn.teleport.dev/teleport-event-handler-v18.10.0-darwin-amd64-bin.tar.gz)
* PagerDuty [Linux amd64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-pagerduty-v18.10.0-linux-arm64-bin.tar.gz)
* Jira [Linux amd64](https://cdn.teleport.dev/teleport-access-jira-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-jira-v18.10.0-linux-arm64-bin.tar.gz)
* Email [Linux amd64](https://cdn.teleport.dev/teleport-access-email-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-email-v18.10.0-linux-arm64-bin.tar.gz)
* Microsoft Teams [Linux amd64](https://cdn.teleport.dev/teleport-access-msteams-v18.10.0-linux-amd64-bin.tar.gz) | [Linux arm64](https://cdn.teleport.dev/teleport-access-msteams-v18.10.0-linux-arm64-bin.tar.gz)