Teleport

Teleport has completed an investigation into the impact of the Linux kernel vulnerability CVE-2026-31431 (“Copy Fail”) on Teleport Cloud. We have found no exploitable attack surface in our production environment. We are hardening our infrastructure by disabling the `algif_aead` kernel module where appropriate. We will apply official patches when they are made available for the Linux distributions used in our cloud platform. We encourage Teleport users to review the impact of this Linux kernel vulnerability on their own infrastructure, as it can be used to escalate privileges on affected operating systems. Note that Teleport does not prevent such an exploit after an authorized SSH connection has been established. Teleport’s Session Recording feature can be used to audit SSH sessions for evidence of exploitation attempts. References: * https://copy.fail/ * https://goteleport.com/docs/reference/architecture/session-recording/

Recent supply chain attacks have compromised the LiteLLM Python package (versions 1.82.7 and 1.82.8) and the Trivy package (version 0.69.4), embedding malicious code designed to steal credentials from affected systems. Teleport has investigated both incidents for impact on our systems and infrastructure, and has concluded that we have not been impacted. Teleport uses Socket to monitor our software supply chain on an ongoing basis, with a specific focus on supply chain attacks like these. We also use Project Discovery Cloud and Wiz for ongoing scanning and monitoring of our platform and web properties.

A wide range of NPM packages have been compromised in the past few months with malware attacks using similar, but varied techniques. This group of attacks is being referred to as "Shai Hulud". Teleport has investigated all currently known compromised packages for impact on our systems, and has concluded that we have not been impacted at this time. Teleport uses Socket to monitor our software supply chain on an ongoing basis, with a specific focus on malware attacks like Shai Hulud. We also use Project Discovery Cloud and Wiz for ongoing scanning and monitoring of our platform and web properties.

CVE-2025-66564 is a high-severity issue in Sigstore's Timestamp Authority. Teleport has applied the patch to our master branch, but the patch version (2.0.3) includes a requirement to update to Go 1.25 which is not currently available in Teleport release branches. Go 1.25 will be available in Teleport releases after it passes our test plan in Q1 of calendar year 2026. As a result, this vulnerability will continue to be picked up by security scanning tools until Teleport is updated to Go 1.25. Teleport security engineers have completed an evaluation of this vulnerability and determined that Teleport is not affected. The vulnerable APIs are not used in Teleport (directly or indirectly). https://nvd.nist.gov/vuln/detail/CVE-2025-66564 https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh

We have completed our investigation into CVE-2025-55182 and CVE-2025-66478, critical RCE vulnerabilities in React and Next.js. Teleport is not impacted.