Major new features

HashiCorp Vault / OpenBao secret backends - #2185

Support for fetching passwords and private keys from a Vault-compatible backend without storing them in the database.

Backends are configured under Config → Secret backends.

^{by @Simonn21}

Vault/OpenBao-signed SSH certificates for target authentication - #2734

SSH targets can now authenticate with a short-lived OpenSSH certificate signed per connection by a Vault / OpenBao secret backend.

^{by @janisdombr}

OIDC back-channel logout - #2740

Warpgate now accepts OpenID Connect Back-Channel Logout requests at /@warpgate/api/sso/providers/<name>/backchannel-logout. When the identity provider signs a user out, it ends their Warpgate sessions on every cluster node. The new disable_local_logout provider option hides Warpgate's own "log out" button when the provider supports single logout.

Custom logo - #2696

Upload your own logo under Config → Parameters

Features

• Graphics Pipeline (RDPEGFX) support for RDP - RDP now negotiates the Graphics Pipeline extension with RemoteFX Progressive and ClearCodec. Adds support for GNOME Remote Desktop and KRDP by @askz in #2621
• SSH: new ssh.target_handshake_timeout config option for targets that accept the TCP connection but never complete the handshake @boenshao in #2641
• fixed #2695 - fuzzy search in the target list in #2714

Security fixes

Moderate GHSA-qcwp-cwqv-g428 - a hostile HTTP target can trigger actions in an active admin's session

A malicious HTTP target could send POST requests to Warpgate API endpoints when accessed by a logged-in admin user.

• Cross-site requests to Warpgate's own API are rejected: state-changing and WebSocket requests to /@warpgate must originate from the control plane host itself (sibling target subdomains no longer count), and sessions on target hosts are limited to the login/logout and MFA endpoints. The UI redirects to the control plane host (http.external_host, falling back to external_host) for those flows

Moderate GHSA-fhwh-r27p-hvg5 - TOTP MFA policy not enforced unless the user's own policy specifies both factors

When a user had an explicit auth policy that did not require MFA, the global MFA policy did not apply to this user. Additionally, a user having both a TOTP credential and a "any credential" policy would be interpreted literally and allow authentication with OTP alone. Now, OTP credentials by themselves are never considered to be sufficient for login.

Moderate GHSA-rm54-2mgh-59g9 - a hostile VNC or RDP target can trigger an unbounded memory allocation

Hostile VNC/RDP targets could report excessive desktop resolutions and trigger unbounded allocations in Warpgate.

Low GHSA-2cwg-f83j-xjgx - HTTP target headers and URL credentials are returned to admins without TargetsEdit

HTTP target header values and the basic auth credentials in the URL are now additionally blanked out for limited admin users without the TargetsEdit permission.

Low GHSA-g5wc-qprw-44ph - ?warpgate-ticket= authenticates the existing HTTP session without rotating its ID

• Using a valid ticket in an existing HTTP session now automatically rotates its key as a defense-in-depth against session fixation attacks

Changes

• Docker: the runtime image is now based on gcr.io/distroless/cc-debian12 (no shell, no package manager), which removes 60+ scanner CVEs from OS packages Warpgate never used. The warpgate user (UID 1000) and /data volume are unchanged by @mtthsbrd in #2705
• fixed #2548 - RDP, VNC and web SSH now show users a fixed phrase when the target connection fails instead of the raw error in #2729
• Closing a session (admin close, user deletion) now also aborts its pending approvals in c73ca3c
• Cluster peers are authenticated via mTLS instead of a static cluster token in #2698
• Web SSH and desktop clients now show connection progress state (waiting for approval, connecting, connected) in #2684
• Large target lists in the gateway UI are now virtualized (#2642) in #2650
• fixed #2633 - the S3 recordings scratch directory is configurable (scratch_path) by @mathieuHa in #2634
• Helm: overrides_config is rendered through tpl, so it can reference other chart values by @vitaly-sinev in #2673

Fixes

• fixed #2658 - SSH port forwarding for RDP with ssh -N was dropped immediately because the forwarded data was mistaken for Ctrl-C by @megative in #2679
• HTTP: query parameters are forwarded to the target verbatim; since 0.27.0 they were re-encoded, breaking upstreams that put opaque data (e.g. bare base64) in the query by @Mac898 in #2704
• fixed #2702 - web approvals satisfied by the grace period no longer show up as pending in the admin UI in #2719
• fixed #2627 - Kubernetes: upstream API clients are reused across requests instead of opening a new connection and TLS handshake for every proxied request by @sthalbert in #2628
• Kubernetes: requests are resent when the upstream TCP connect or TLS handshake fails, instead of returning a 500 to kubectl in #2718
• Kubernetes: closing a session (admin close, user deletion) now actually ends its in-flight exec/attach/port-forward and watch/log streams in #2720
• SSH public keys added through the user profile had their comment stored, which made login with that key fail by @fergusean in #2666
• Recordings were marked complete before all of their streams had finished uploading (S3) in #2652
• Adding a TOTP credential through the admin API now updates the user's credential policy to require it, as the UI already did in f8590e2
• VNC: target connect and handshake are now bounded by the same 10s / 30s deadlines as RDP in 8de78f5
• Admin UI: the search box did nothing on the Admin roles and Target groups pages in 1c16a9f
• API tokens: expiry picker used UTC instead of local time, treated the preset as milliseconds and showed the maximum in whole days only in 2a2c2c4

Security hardening

• Target credentials are now redacted in the admin API responses for admins without the Targets Edit permission in #2685
• The session cookie is now always marked Secure by @mtthsbrd in #2675
• Added X-Content-Type-Options: nosniff, Referrer-Policy: same-origin and X-Frame-Options: SAMEORIGIN headers by @mtthsbrd in #2676
• X-Forwarded-For / -Host / -Proto now use the last value and ignore invalid values in 1d41778

New Contributors

• @Simonn21 made their first contribution in #2185
• @sthalbert made their first contribution in #2628
• @megative made their first contribution in #2679
• @vitaly-sinev made their first contribution in #2673
• @askz made their first contribution in #2621
• @k176060444-lgtm made their first contribution in #2669
• @Mac898 made their first contribution in #2704
• @boenshao made their first contribution in #2641

Full Changelog: v0.29.2...v0.30.0