No impact incident

Teleport Cloud: Security Maintenance

Affected: Cloud Service

Current status of Teleport Cloud: Operational — live Teleport Cloud status

Timeline

1. Oct 20, 2026, 02:53 UTC
   identified
   We are aware of CVE-2026-111943 and are evaluating its impact on Teleport and Teleport Cloud. We will share details and any action items as they become available. We are preparing Teleport releases built with the updated Go version. We will post an update by 10/20/26 9:00 AM PDT or sooner if we have new information.
2. Oct 20, 2026, 16:20 UTC
   identified
   We investigated the impact of CVE-2026-111943 and prepared updated releases of Teleport (18.11.6 and 17.7.31). These releases were built with a patched Go version protected against CVE-2026-111943. While this vulnerability does not directly affect the Teleport CA, Teleport relies on TLS/HTTPS for intercomponent communication and integration with external services like SSO, leaving those integration points potentially vulnerable. We encourage self-hosted customers to update all Teleport components (agents and client tools) to a patched version as soon as possible. We have begun an emergency rollout to update Teleport and Teleport Cloud itself. During this window customers may experience connection drops as we upgrade and restart components. For customers enrolled in managed updates, agents and tools will automatically be upgraded to a patched version. We will post an update by 10/21/26 9:00 AM PDT or sooner if we have additional updates.
3. Oct 21, 2026, 00:42 UTC
   identified
   We continue to mitigate CVE-2026-111943. We encourage all customers to apply updates from their operating system vendor that remove eMudhra from their trust store and to update to a patched version of Teleport that does not validate certificates that eMudhra issues. Teleport 18.11.6 and 17.7.31 do not validate certificates that eMudhra issues. For self-hosted customers, we encourage you to update all Teleport services to Teleport 18.11.6 and 17.7.31 as soon as possible. Downloads can be obtained from your dashboard directly or through all package managers maintained by Teleport, including apt, yum, and helm. Users should back up the Teleport cluster, then follow the standard Teleport upgrade procedure. For Cloud customers, no action is required at this time. We are rolling any Teleport and Teleport Cloud components that this issue might affect and pushing out agent and tools updates through Managed Updates. Cloud customers may experience intermittent connectivity issues if a Teleport Cloud component we are updating doesn’t support connection resumption. We expect this process to last at least through the end of the week. We will post an update by 10/21/26 9:00 AM PDT or sooner if we have additional updates.
4. Oct 24, 2026, 02:06 UTC
   identified
   We continue to mitigate CVE-2026-111943. We have fully patched all Cloud tenants (control plane, tools, and agents). We continue to patch all other components of Teleport Cloud. We expect this process to continue for at least another week. Customers may experience intermittent connectivity issues if a Teleport Cloud component that we are updating does not support connection resumption. For self-hosted customers, we encourage you to update all Teleport services to Teleport 18.11.7 and 17.7.32 as soon as possible. Downloads can be obtained from your dashboard directly or through all package managers maintained by Teleport, including apt, yum, and helm. Users should back up the Teleport cluster, then follow the standard Teleport upgrade procedure. We encourage all customers to apply updates from their operating system vendor that remove eMudhra from their trust store for both servers and endpoints. We will post an update by 10/30/26 6:00 PM PDT or sooner if we have additional updates.

Updates as published by Teleport Cloud (original).