We investigated the impact of CVE-2026-111943 and prepared updated releases of Teleport (18.11.6 and 17.7.31). These releases were built with a patched Go version protected against CVE-2026-111943.
While this vulnerability does not directly affect the Teleport CA, Teleport relies on TLS/HTTPS for intercomponent communication and integration with external services like SSO, leaving those integration points potentially vulnerable.
We encourage self-hosted customers to update all Teleport components (agents and client tools) to a patched version as soon as possible.
We have begun an emergency rollout to update Teleport and Teleport Cloud itself. During this window customers may experience connection drops as we upgrade and restart components. For customers enrolled in managed updates, agents and tools will automatically be upgraded to a patched version.
We will post an update by 10/21/26 9:00 AM PDT or sooner if we have additional updates.
Posted Oct 20, 2026 - 16:20 UTC
Identified
We are aware of CVE-2026-111943 and are evaluating its impact on Teleport and Teleport Cloud. We will share details and any action items as they become available.
We are preparing Teleport releases built with the updated Go version.
We will post an update by 10/20/26 9:00 AM PDT or sooner if we have new information.