Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/gravitational/teleport

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8GoPublished

    Teleport allows remote authentication bypass

    CVE-2025-49825 · GHSA-8cqv-pj7f-pwpc

    Affected
    • Go github.com/gravitational/teleport >= 17.0.0, < 17.5.2; >= 16.0.0, < 16.5.12; >= 15.0.0, < 15.5.3; >= 14.0.0, < 14.4.1; >= 13.0.0, < 13.4.27; >= 0.0.11, < 12.4.35; <= 0.0.0-20250616162021-79b2f26125a1
    Fixed in
    16.5.1213.4.2717.5.215.5.312.4.3514.4.1· Partial vendor fix
    Issue
    Impact A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade. Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport. Teleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren’t affected. For the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution. Have questions? - OSS Community: opensource@goteleport.com - Legal: legal@goteleport.com - Security: security@goteleport.com - Customer Support: goteleport.com/support - Media Inquiries: teleport@babelpr.com Patches Fixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35. These patches are available only on the official Teleport distribution channels. These versions are designated as Critical Security Exception Versions. For these specific…

    Recommended action: Upgrade to 17.5.2, 16.5.12, 15.5.3 or 3 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.8GoPublished

    Improper token validation leading to code execution in Teleport

    CVE-2022-36633 · GHSA-6xf3-5hp7-xqqg

    Affected
    • Go github.com/gravitational/teleport < 8.3.17; >= 9.0.0, < 9.3.13; >= 10.0.0, < 10.1.2
    Fixed in
    10.1.29.3.138.3.17· Vendor fix available
    Issue
    Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

    Recommended action: Upgrade to 10.1.2, 9.3.13 or 8.3.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →