Features

• Kubernetes exec, attach, port-forward and debug container usage is now logged in the structured audit log by @huguesgr in #2558

Fixes

• fixed #2597 - the public key and SSO credential update endpoints allowed moving credentials between users by @Eugeny in cee6464
• fixed #2598 - commands and subsystems started through a pending session approval were not recorded by @fukajan in 4b5f9c7
• A malformed external_host (a URL, a host:port pair) is now parsed (best effort) or produces a config warning by @Eugeny in 5b5cabf
• Admin and gateway API error responses now log the reason for the failure by @Eugeny in 79182c0
• 3xx HTTP responses are no longer logged as errors by @Eugeny in 4c0d046

Full Changelog: v0.29.0-beta.2...v0.29.0-beta.3

Features

• Support tickets for Kubernetes access by @LarsSven in #2562
• Deleting a user now closes all of their active sessions by @Eugeny in 7ad4017

Fixes

• fixed #2590 - a race when running SQLite migrations by @Eugeny in #2595
• fixed #2594 - TOTP secrets created in the admin UI are now generated with a CSPRNG by @Eugeny in 79bbe01
• SSH: when a target dies, the client is now sent a disconnect instead of being left hanging (#2520) by @janisdombr in #2549
• Live UI updates (sessions/approvals) now work across cluster nodes by @Eugeny in #2587
• fixed #2585 - a malformed RDP handshake could spin a CPU core by @Eugeny in #2591

Full Changelog: v0.29.0-beta.1...v0.29.0-beta.2

Features

• Session approvals (JIT access): targets can now require an admin to approve each session before the connection is allowed, with configurable timeout and approval caching by @Eugeny in #2563
• MFA enforcement policy: a global setting to require or prompt enrollment of a second factor for all users, with an option to exempt SSO users by @Eugeny in #2555
• Default credential policy setting for new users, editable under Config → Policies by @Eugeny in #2557 (fixes #2556)
• Sessions are now split into user sessions and target sessions, so a single HTTP session lists all its target connections together in the admin UI by @Eugeny in #2499
• SSH host keys are now stored in the database instead of the data directory. Existing key files are imported automatically. in #2570

Fixes

• Internal error details (database, LDAP, TLS, upstream errors) are now hidden in HTTP responses; end users will see a correlation ID that can be cross-referenced to the server logs by @janisdombr in #2547
• SSH: sessions with a large amount of output could end without the client being told the channel was closed, leaving ssh hanging by @janisdombr in #2521
• fixed #2536 - do not record keypresses during interactive RDP logon, add an option to disable keyboard recording completely by @Eugeny in #2537
• Keep the auto-reconnect secret out of the RDP logon log line by @janisdombr in #2542

Other

• Docker images migrated from Debian bullseye to bookworm by @janisdombr in #2550

Full Changelog: v0.28.6...v0.29.0

Features

• RDP interactive logon option (#2526)

The new RDP target option can force users to log in again at the Windows login screen instead of logging them in automatically

Fixes

• fixed #2522 - do not show empty admin page for non-admin users, allow ctrl-clicking ssh and desktop targets
• fixed #2492 - disable RDP dithering (#2524)

Full Changelog: v0.28.5...v0.28.6

Features

• RDP: add an option to force lossless compression between Warpgate and target by @Eugeny in #2493

Fixes

• fixed #2489 - serve gen1 recordings from S3 storage by @Eugeny in #2501
• fixed #2494 - temporarily introduce channel budgets by @Eugeny in #2502
• fixed #2498 - prevent a hanging channel open from hanging up the entire session by @Eugeny in #2503
• Reject discovered IdP endpoints with a non-HTTP scheme by @theredspoon in #2427
• fixed #2495 - show ticket instructions for self-service tickets for targets without RBAC access by @Eugeny in #2504
• fixed #1815 - handle Authentik bug when SSO secret is not url-encodable by @Eugeny in #2505
• fixed #1569 - enable ssh-dss when insecure ciphers are allowed by @Eugeny in #2506
• Align WebSocket header behaviour with HTTP behaviour by @LarsSven in #2507

New Contributors

• @theredspoon made their first contribution in #2427

Full Changelog: v0.28.4...v0.28.5

Security fixes

GHSA-fjgc-484v-j6mf - missing permission check on update_user_role API endpoint

Suggested action: update immediately if using scoped admin accounts without AccessRolesAssign permission.

An scoped admin user without the AccessRolesAssign permission was able to re-enable existing expired or revoked access role assignments due to a missing permission check, allowing them to reinstate target access for a user that used to have it in the past.

Changes

• Added SQLite CLI to the Docker image to make database backups more convenient
• Improved RDP web client performance

Fixes

• fixed #2485 - fixed-resolution RDP clients not passing resolution by @Eugeny in #2486
• #2489 - remove locking from SessionRecordings by @Eugeny in #2490
• fixed #2487 - RDP - handle unstable bitmap parse order in Chromium by @Eugeny in #2491

Full Changelog: v0.28.3...v0.28.4

Features

• introduce warpgate copy-database command by @Eugeny in #2475

Fixes

• fix(ssh): respect configured auth methods on rejection by @fergusean in #2468
• fix(ssh): prevent progress overwriting host key confirmation prompts by @Eugeny in #2478
• fix: reject target rename when the name is already taken by @BetterAndBetterII in #2470

New Contributors

• @fergusean made their first contribution in #2468

Full Changelog: v0.28.2...v0.28.3

Security fixes

GHSA-78rf-vg74-7cr8 - Unauthenticated connection can stall the accept loop, denying service to a protocol - #2462

Suggested action: upgrade ASAP.

A malicious or slow client can hold up the listener loop for a protocol, denying service to other clients. For Kubernetes, a single client can hold up the listener indefinitely, for other protocols it's for 1 second, or for 6 seconds if PROXY protocol is enabled.

Fixes

• fix: sort SSH target menu with natural numeric order by @BetterAndBetterII in #2464

New Contributors

• @BetterAndBetterII made their first contribution in #2464

Full Changelog: v0.28.1...v0.28.2

Features

• RDP: mstsc live resize support by @Eugeny in #2461

Fixes

• fixed #2457 - upgrade vt100 to fix resizing panic by @Eugeny in #2460
• fixed #2453 - setup CLI recreates admin user every time
• fixed #2449 - cannot unset nullable parameters via API

Full Changelog: v0.28.0...v0.28.1

Before we start

Would you kindly spend 5 minutes and give your feedback on the your deployment and issues? Thank you 🙏

Subscribe to these major release notes as well as vulnerability alerts via email: 👉 https://warpgate.null.page/newsletter/

Survey results so far

Most responses were anonymous, and this is the public follow-up.

Some requested changes were already in progress while the survey was going on, and some were completed shortly afterwards.

The 0.27.x and 0.28.0 releases address several recurring requests form the survey: clustering, RDP clipboard redirection, faster playback of long terminal recordings, SSH command auditing, credential encryption at rest, and fixing IP restrictions for API tokens.

Other requests—including SSO improvements, backup and upgrade guidance, observability, SSH certificates, and web-SSH file transfer—remain on the radar.

If you responded anonymously but would like a follow-up, feel free to re-submit the survey with your email address.

Features

Credential encryption at rest - #2386

Warpgate now offers encrypting database-stored target credentials at rest. You should enable it when using an external MySQL/PostgreSQL database.

Generate a master key with openssl rand -base64 32 and set it via the WARPGATE_ENCRYPTION_KEY environment variable to automatically encrypt all present and future credentials in the database on the next service restart.

SSH shell command auditing - #2407

Commands typed by the user in an SSH shell session now emit audit log events.

Seeking index for terminal recordings - #2419

Long terminal recordings now load incrementally in the UI. Only applies to recordings made in the new version.

Changes

• feat: Make target groups collapsible by @sravan-blitz in #2387
• fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
• allow admin to configure new tab preference by @LarsSven in #2396
• fixed #2395 - slim down connection instructions UI by @Eugeny in #2409
• link to user/target from session view by @Eugeny in #2450

Fixes

• allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
• hash token and ticket secrets in the database by @Eugeny in #2410
• record password login failures even if password login is disabled by @Eugeny in #2408
• fixed #2392 - cast the log values JSON column to text when searching by @huguesgr in #2417
• fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
• fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443
• count SSH pubkey failures towards IP blocking by @Eugeny in #2454

New Contributors

• @janisdombr made their first contribution in #2435
• @sravan-blitz made their first contribution in #2387
• @huguesgr made their first contribution in #2417

Full Changelog: v0.27.4...v0.28.0