gravitational/teleport v16.4.17 on GitHub

Description

Escape user provided labels when creating the shell script that enrolls servers, applications and databases into Teleport. #52705
Support setting the public address for discovered apps based on Kubernetes annotations. #52701
Workload ID: Support for Teleport Predicate Language in Workload Identity templates and rules. #52565
Fixed cannot execute: required file not found error with the teleport-spacelift-runner image. #52561
Added support for X509 revocations to Workload Identity. #52502
Updated go-jose/v4 to v4.0.5 (addresses CVE-2025-27144). #52468
Updated /x/crypto and /x/oauth2 (addresses CVE-2025-22869 and CVE-2025-22868). #52438
Logging out from a cluster no longer clears the client autoupdate binaries. #52338
Added JSON response support to the /webapi/auth/export public certificate API endpoint. #52326
Resolved an issue with tbot where the web proxy port would be used instead of the SSH proxy port when ports separate mode is in use. #52309
Fixed Azure SQL Servers connect failures when the database agent runs on a VM scale set. #52268
Removed the ability of tctl to load the default configuration file on Windows. #52189
Added support for non-FIPS AWS endpoints for IAM and STS on FIPS binaries (TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes). #52129
Introduced the allow_reissue property to the tbot identity output for compatibility with tsh based reissuance. #52115

Enterprise:

Download the current and previous releases of Teleport at https://goteleport.com/download.

Download the current release of Teleport plugins from the links below.