rewindex

ChangesTeleportSecurity Maintenance

Teleport: Incident updated: Security Maintenance

Incident updateNormal progress (rule, 100%)Changed stspg.io (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Teleport removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: identified
After: resolved
AddedResolved time#2
Before: not present
After: 2026-10-29 16:27 UTC
AddedUpdateresolved#3
Before: not present
After: We investigated the impact of CVE-2026-111943 (eMudhra Intermediate CA Compromise) and prepared updated releases of Teleport (18.11.7 and 17.7.32). These releases were built with a patched Go version protected against CVE-2026-111943. While this vulnerability does not directly affect the Teleport CA, Teleport relies on TLS/HTTPS for intercomponent communication and integration with external services like SSO, leaving those integration points potentially vulnerable. We have fully patched all Cloud tenants (control plane, tools, and agents). We have also patched all ancillary components of the Teleport Cloud infrastructure. We are encouraging all customers to both apply updates from their operating system vendor that remove eMudhra from their trust store and to update to a patched version of Teleport that does not validate certificates that eMudhra issues. For self-hosted customers, we encourage you to update all Teleport services to Teleport 18.11.7 and 17.7.32 as soon as possible. Downloads can be obtained from your dashboard directly or through all package managers maintained by Teleport, including apt, yum, and helm. Users should back up the Teleport cluster, then follow the standard Teleport upgrade procedure.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Thursday, October 29

1 incident change

Saturday, October 24

1 incident change

Wednesday, October 21

1 rewrite, 1 incident change

Tuesday, October 20

1 incident change

Cite this

Incident updated: Security Maintenance on Teleport’s status page, changed 2026-10-29 16:33 UTC (change 5 of 5).

Title
Incident updated: Security Maintenance
Vendor
Teleport
Date
URL
https://rewindex.com/change/r7328a850ea997a

All Teleport changesTeleport profileMarkdownJSON