Added support for LSA protection, the Teleport Windows authentication package can now be used on hosts with LSA protection (RunAsPPL) enabled.
Fixed an issue where Windows authentication would fail with Teleport-managed non-AD users.
Fixed an issue causing the bot web UI page to crash when the cluster has 1000 bots with many traits. Performance of the page will be improved in a later release.
Added a new command, tsh mcp login, to provide OAuth authentication support for MCP servers in tsh.
Fixed an issue that caused Teleport Connect to leak connections to the local SSH agent.
Updated Go to 1.26.8.
Running tsh proxy kube with per-session MFA now performs a single MFA ceremony covering all requested Kubernetes clusters instead of one per cluster, and issues per-cluster certificates concurrently.
The tsh proxy kube command now issues a single shared certificate for Kubernetes clusters that do not require per-session MFA, reducing certificate issuances across large fan-outs.
Improved OpenTelemetry tracing configuration mechanism in tbot.
Fixed Bot kind not being reported accurately in heartbeats.
Improved SCIM group member addition performance.
Fixed tsh kubectl exec masking exit codes.
Fixed an issue in tbot's workload-identity-api service where slow connections to the Teleport Proxy could result in timeouts.
Added ldap_host and ldap_tls_server_name options to the database service's AD config, letting the LDAP endpoint and its TLS server name be configured separately from kdc_host_name.
Added a pki_domain option to the database service's AD config, letting the CRL-publishing domain be configured separately from domain.
Added tctl plugin support for Github and SCIM plugins.
Fixed loss of Bound Keypair token status on update by always preserving the existing token's status, ensuring bots and agents can not have their credentials deleted accidentally.
Added support for RDS Proxy discovery configuration in teleport/discovery/aws Terraform module.
Added CA override support to SQL Server PKINIT databases. The complete trust chain must be present in the CA override definition, otherwise kinit won't be able to validate its own certificate.
Added support for ambient credentials in teleport/discovery/aws Terraform module.
Fixed Error parsing application context error when trying to use bash auto completes generated by tbot or teleport-update.
Support --iac=terraform for tctl acl create and tctl acl update commands that print the Terraform config for the resulting resources instead of applying the change (dry-run).
Improved search in the user pickers to match username only.
Fixed tsh scp failing to spawn a SFTP server if the user home directory was not found. Non-existent files will still fail but absolute paths will be handled gracefully.
Fixed regression where joining when the token name contains : followed by base64 would result in a not found error.
Fixed access request reason requirement (request.reason.mode: required) being ignored when requestable roles were specified with a wildcard, regexp, or claims_to_roles instead of literal role names.
Improved output of tctl plugins command.
Changed tctl auth crl to export CA override CRLs, in addition to the self-signed CA CRLs.
Fixed an issue that prevented the correct version from being displayed for tctl builds on macOS.
Added draft, enforce, and 30-minute test run controls to the IP Allowlist panel for Teleport Cloud, backed by new mode and expires fields on the client_ip_restriction resource.
Reduced memory allocations on the VNet network stack data path.
Improved VNet throughput by increasing the TUN MTU to 16 KiB.
Added teleport reconfigure to generate a new agent configuration file from an existing one.
Added support for using the tpm join method with scoped tokens.
Added scope namespacing to ssh servers.
Scoped bots can now issue application-routed certificates through tbot's.
Added support for the GitLab CI join method with scoped join tokens, including scoped Bot.
Updated Entra ID edit plugin UI to support sync interval configuration.
VNet no longer rewrites /etc/resolver files on macOS when the DNS configuration is unchanged.
Reduced VNet memory allocations when handling DNS queries.
Fixed Redshift automatic user cleanup after a PostgreSQL client disconnects during connection setup.
EC2 auto-discovery now fetches instances across AWS accounts and regions concurrently with bounded concurrency.
Fixed potential deadlock/segfault when using libnss-extrausers on Linux agents with user creation enabled.
