Features

• RDP interactive logon option (#2526)

The new RDP target option can force users to log in again at the Windows login screen instead of logging them in automatically

Fixes

• fixed #2522 - do not show empty admin page for non-admin users, allow ctrl-clicking ssh and desktop targets
• fixed #2492 - disable RDP dithering (#2524)

Full Changelog: v0.28.5...v0.28.6

Features

• RDP: add an option to force lossless compression between Warpgate and target by @Eugeny in #2493

Fixes

• fixed #2489 - serve gen1 recordings from S3 storage by @Eugeny in #2501
• fixed #2494 - temporarily introduce channel budgets by @Eugeny in #2502
• fixed #2498 - prevent a hanging channel open from hanging up the entire session by @Eugeny in #2503
• Reject discovered IdP endpoints with a non-HTTP scheme by @theredspoon in #2427
• fixed #2495 - show ticket instructions for self-service tickets for targets without RBAC access by @Eugeny in #2504
• fixed #1815 - handle Authentik bug when SSO secret is not url-encodable by @Eugeny in #2505
• fixed #1569 - enable ssh-dss when insecure ciphers are allowed by @Eugeny in #2506
• Align WebSocket header behaviour with HTTP behaviour by @LarsSven in #2507

New Contributors

• @theredspoon made their first contribution in #2427

Full Changelog: v0.28.4...v0.28.5

Security fixes

GHSA-fjgc-484v-j6mf - missing permission check on update_user_role API endpoint

Suggested action: update immediately if using scoped admin accounts without AccessRolesAssign permission.

An scoped admin user without the AccessRolesAssign permission was able to re-enable existing expired or revoked access role assignments due to a missing permission check, allowing them to reinstate target access for a user that used to have it in the past.

Changes

• Added SQLite CLI to the Docker image to make database backups more convenient
• Improved RDP web client performance

Fixes

• fixed #2485 - fixed-resolution RDP clients not passing resolution by @Eugeny in #2486
• #2489 - remove locking from SessionRecordings by @Eugeny in #2490
• fixed #2487 - RDP - handle unstable bitmap parse order in Chromium by @Eugeny in #2491

Full Changelog: v0.28.3...v0.28.4

Features

• introduce warpgate copy-database command by @Eugeny in #2475

Fixes

• fix(ssh): respect configured auth methods on rejection by @fergusean in #2468
• fix(ssh): prevent progress overwriting host key confirmation prompts by @Eugeny in #2478
• fix: reject target rename when the name is already taken by @BetterAndBetterII in #2470

New Contributors

• @fergusean made their first contribution in #2468

Full Changelog: v0.28.2...v0.28.3

Security fixes

GHSA-78rf-vg74-7cr8 - Unauthenticated connection can stall the accept loop, denying service to a protocol - #2462

Suggested action: upgrade ASAP.

A malicious or slow client can hold up the listener loop for a protocol, denying service to other clients. For Kubernetes, a single client can hold up the listener indefinitely, for other protocols it's for 1 second, or for 6 seconds if PROXY protocol is enabled.

Fixes

• fix: sort SSH target menu with natural numeric order by @BetterAndBetterII in #2464

New Contributors

• @BetterAndBetterII made their first contribution in #2464

Full Changelog: v0.28.1...v0.28.2

Features

• RDP: mstsc live resize support by @Eugeny in #2461

Fixes

• fixed #2457 - upgrade vt100 to fix resizing panic by @Eugeny in #2460
• fixed #2453 - setup CLI recreates admin user every time
• fixed #2449 - cannot unset nullable parameters via API

Full Changelog: v0.28.0...v0.28.1

Before we start

Would you kindly spend 5 minutes and give your feedback on the your deployment and issues? Thank you 🙏

Subscribe to these major release notes as well as vulnerability alerts via email: 👉 https://warpgate.null.page/newsletter/

Survey results so far

Most responses were anonymous, and this is the public follow-up.

Some requested changes were already in progress while the survey was going on, and some were completed shortly afterwards.

The 0.27.x and 0.28.0 releases address several recurring requests form the survey: clustering, RDP clipboard redirection, faster playback of long terminal recordings, SSH command auditing, credential encryption at rest, and fixing IP restrictions for API tokens.

Other requests—including SSO improvements, backup and upgrade guidance, observability, SSH certificates, and web-SSH file transfer—remain on the radar.

If you responded anonymously but would like a follow-up, feel free to re-submit the survey with your email address.

Features

Credential encryption at rest - #2386

Warpgate now offers encrypting database-stored target credentials at rest. You should enable it when using an external MySQL/PostgreSQL database.

Generate a master key with openssl rand -base64 32 and set it via the WARPGATE_ENCRYPTION_KEY environment variable to automatically encrypt all present and future credentials in the database on the next service restart.

SSH shell command auditing - #2407

Commands typed by the user in an SSH shell session now emit audit log events.

Seeking index for terminal recordings - #2419

Long terminal recordings now load incrementally in the UI. Only applies to recordings made in the new version.

Changes

• feat: Make target groups collapsible by @sravan-blitz in #2387
• fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
• allow admin to configure new tab preference by @LarsSven in #2396
• fixed #2395 - slim down connection instructions UI by @Eugeny in #2409
• link to user/target from session view by @Eugeny in #2450

Fixes

• allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
• hash token and ticket secrets in the database by @Eugeny in #2410
• record password login failures even if password login is disabled by @Eugeny in #2408
• fixed #2392 - cast the log values JSON column to text when searching by @huguesgr in #2417
• fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
• fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443
• count SSH pubkey failures towards IP blocking by @Eugeny in #2454

New Contributors

• @janisdombr made their first contribution in #2435
• @sravan-blitz made their first contribution in #2387
• @huguesgr made their first contribution in #2417

Full Changelog: v0.27.4...v0.28.0

Changes

• link to user/target from session view by @Eugeny in #2450
• Count SSH pubkey failures towards IP blocking by @Eugeny in #2454

Full Changelog: v0.28.0-beta.3...v0.28.0-beta.4

Features

• feat: Make target groups collapsible by @sravan-blitz in #2387
• fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
• Allow admin to configure new tab preference by @LarsSven in #2396

Fixes

• fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
• fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443

New Contributors

• @janisdombr made their first contribution in #2435
• @sravan-blitz made their first contribution in #2387

Full Changelog: v0.28.0-beta.2...v0.28.0-beta.3

Changes

• generate seeking index for terminal recordings by @Eugeny in #2419
• fixed #2395 - slim down connection instructions UI by @Eugeny in #2409

Fixes

• Allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
• hash token and ticket secrets in the database by @Eugeny in #2410
• fixed #2399 - audit detected shell commands for web-ssh sessions by @Eugeny in #2407
• record password login failure even if password login is disabled by @Eugeny in #2408
• fixed #2392 - cast the log values JSON column to text when searching by @huguesgr in #2417

New Contributors

• @huguesgr made their first contribution in #2417

Full Changelog: v0.27.6...v0.28.0-beta.2