v6.71.8 (2026-10-21)
Security
- Remediate compromised eMudhra certificate chains in Linux and Windows image trust stores, including the separate AWS CLI and Git for Windows CA bundles #1944 (@scadu).
Changed
Fixed
- Fix Windows image reboot and WinRM provisioning races, and validate Docker before publishing the base image #1944 (@scadu).
Agent Changelog (v3.138.2)
v3.138.2
Important security update
Upgrade to v3.138.2 promptly. This release addresses compromised eMudhra certificate chains (CVE-2026-111943) by building the agent with Go 1.26.10, which rejects the affected chains, including alternate cross-signed paths.
Installing the updated agent is required to receive this protection. It doesn't update OS, container or custom trust stores, or protect external tools run by jobs; remediate those separately.
What's Changed
🔒 Security
- Reject compromised eMudhra certificate chains (CVE-2026-111943) by building with Go 1.26.10 by @moskyb in buildkite/agent#4551
- Prevent artifact downloads escaping their destination through directory symlinks, unless the
allow-artifact-path-traversalexperiment is enabled by @isaacsu in buildkite/agent#4548 - Update
github.com/lestrrat-go/jwx/v3to 3.3.0 to fix JSON member-name escaping (GHSA-4cf7-xm37-g63h) by @dependabot[bot] in buildkite/agent#4366 - Update
github.com/klauspost/compressto fix a zstd decoder crash on crafted input (GHSA-fpmh-frq8-7rj8) by @dependabot[bot] in buildkite/agent#4345
🏠 Internal
- Replace deprecated HTTP/2 transport configuration to unblock dependency upgrades by @isaacsu in buildkite/agent#4547
- Dependency updates by @dependabot[bot] in buildkite/agent#4301, buildkite/agent#4392, buildkite/agent#4391, buildkite/agent#4365, buildkite/agent#4543, buildkite/agent#4393 and buildkite/agent#4549
Full Changelog: buildkite/agent@v3.138.1...v3.138.2
Upgrading
Perform a CloudFormation stack update with the following URL:
https://s3.amazonaws.com/buildkite-aws-stack/v6.71.8/aws-stack.yml
If you want to launch a new stack, you can use this link (make sure not to use your production AWS account, create a new one for CI):