Security Maintenance

Update timeline

1. identified Oct 20, 2026, 02:53 AM UTC

   We are aware of CVE-2026-111943 and are evaluating its impact on Teleport and Teleport Cloud. We will share details and any action items as they become available. We are preparing Teleport releases built with the updated Go version. We will post an update by 10/20/26 9:00 AM PDT or sooner if we have new information.

2. identified Oct 20, 2026, 04:20 PM UTC

   We investigated the impact of CVE-2026-111943 and prepared updated releases of Teleport (18.11.6 and 17.7.31). These releases were built with a patched Go version protected against CVE-2026-111943. While this vulnerability does not directly affect the Teleport CA, Teleport relies on TLS/HTTPS for intercomponent communication and integration with external services like SSO, leaving those integration points potentially vulnerable. We encourage self-hosted customers to update all Teleport components (agents and client tools) to a patched version as soon as possible. We have begun an emergency rollout to update Teleport and Teleport Cloud itself. During this window customers may experience connection drops as we upgrade and restart components. For customers enrolled in managed updates, agents and tools will automatically be upgraded to a patched version. We will post an update by 10/21/26 9:00 AM PDT or sooner if we have additional updates.

3. identified Oct 21, 2026, 12:42 AM UTC

   We continue to mitigate CVE-2026-111943. We encourage all customers to apply updates from their operating system vendor that remove eMudhra from their trust store and to update to a patched version of Teleport that does not validate certificates that eMudhra issues. Teleport 18.11.6 and 17.7.31 do not validate certificates that eMudhra issues. For self-hosted customers, we encourage you to update all Teleport services to Teleport 18.11.6 and 17.7.31 as soon as possible. Downloads can be obtained from your dashboard directly or through all package managers maintained by Teleport, including apt, yum, and helm. Users should back up the Teleport cluster, then follow the standard Teleport upgrade procedure. For Cloud customers, no action is required at this time. We are rolling any Teleport and Teleport Cloud components that this issue might affect and pushing out agent and tools updates through Managed Updates. Cloud customers may experience intermittent connectivity issues if a Teleport Cloud component we are updating doesn’t support connection resumption. We expect this process to last at least through the end of the week. You can share this message with customers with the following link: https://status.teleport.sh/incidents/gzpxt06ftn8z We will post an update by 10/21/26 9:00 AM PDT or sooner if we have additional updates.