chore(deps): update teleport to v18.7.6#21442
Open
uniget-bot wants to merge 1 commit intomainfrom
Open
Conversation
nicholasdille-bot
approved these changes
May 1, 2026
nicholasdille-bot
left a comment
nicholasdille-bot
left a comment
There was a problem hiding this comment.
Auto-approved because label type/renovate is present.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
18.7.2→18.7.6Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
gravitational/teleport (teleport)
v18.7.6: Teleport 18.7.6Compare Source
Description
Security fixes
This release includes various security-related improvements and bug fixes.
We recommend that users on versions prior to v18.7.4 upgrade their Auth and Database Services to this latest release.
For Teleport Cloud customers, your control plane has already been upgraded to a patched release.
[High] Authorization bypass in encrypted session recordings
Teleport did not ensure sufficient authorization in some of the encrypted session recordings APIs.
This could allow an attacker to upload recordings to the cluster.
For self-hosted users that do not use encrypted session recordings, the following debug log messages
on auth server would indicate vulnerable APIs being called:
This issue specifically affects Teleport v18. We recommend that all users upgrade their
Auth Services to this release to ensure continued security and stability.
[High] Cross-node session recording access
When checking system service access to session recordings and audit logs, Teleport did not
perform sufficient authorization. This could allow a compromised Teleport SSH node service to
access audit events and session recordings from other nodes in the cluster.
We recommend that all users upgrade their Auth Services to this release to ensure continued security and stability.
[Medium] SSRF via AWS database access endpoint
Teleport did not sufficiently validate the connection endpoint for AWS database access
(DynamoDB, OpenSearch, Keyspaces). This could allow a malicious actor with access to Teleport
configuration to steal database access credentials by crafting a connection endpoint pointing to
their domain.
All users that use Teleport to access AWS-hosted databases (DynamoDB, OpenSearch, Keyspaces)
are advised to upgrade their Auth and Database Services to this release to ensure continued security
and stability.
Other fixes and improvements
tctl edit plugin/jamfcould break other plugins when providing non-zero duration value. #66191skip_initial_connectionoption to theteleportmwiprovider to allow lazy initialization of the provider. #66139tsh scan keyscould leak resources on a server error; this affected only clusters with Access Graph enabled. #66076teleport_app_active_sessionsPrometheus gauge withapplabel for app access agent autoscaling. #66050HTTPS_PROXYis set. #65924user.metadata.namevariable to RBAC role templates and expressions. #65923ui_configresource support to the Terraform provider. #65800UIConfigresource asui-config. #65800bound_keypairjoin method. #65625tctl discovery nodescommand for troubleshooting AWS EC2 auto-discovery enrollment issues. #65598lockresource support to the Kubernetes operator. #65543*and$globbing to the GitHub Actions token rules. #65539tbot keypair createcommand will now create the specified directory if necessary. #65528teleport.dev/labels for Azure and GCP auto-discovered VMs, making subscription ID, VM ID, region, resource group, VM name, and zone available in the web UI, CLI output, and RBAC rules. #65462contains(set, item)expression. #65294locksupport to the Terraform Provider. #65134teleport-clusterchart causing someauth.*values to not be used when rendering hooks or config manifests. #65131tctl get tokenswould prompt for admin MFA three times rather than once. #65084tbot. #64899tsh aws-profilecommand. #64777tctl recordings download <session_id>completed successfully. #64721teleport-kube-agentchart. #64706teleport-kube-agent-updaterandteleport-spiffe-daemon-set. #64686tctl aclcommands for managing access list reviews. #64587tsh login --request-idto display up to date profile information including the assumed access request and roles. #64536Enterprise:
.were not permitted in an instance profile ARN when setting up session summaries inference.Download
Download the current and previous releases of Teleport at https://goteleport.com/download.
Plugins
Download the current release of Teleport plugins from the links below.
labels: security-patch=yes,security-patch-alts=v18.7.4|v18.7.5
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.