Changelog

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.2

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

Bug Fixes

• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed orb import for site administrators, which failed with an authorization error. A failed downstream lookup during a permission check no longer stops the whole check.
• Fixed context permission checks on Server. Users can edit context environment variables and run jobs that use a context without an organization check that does not apply to Server.
• Fixed the project settings overview page, which showed a Not Found error. The page no longer calls an extra organizations endpoint to decide if the user is an admin.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to an endpoint that Server does not deploy, or to CircleCI cloud on an install without a configured hostname. These requests failed silently, so no data reached either service and no data was ever shared with CircleCI. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56857, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032, CVE-2026-111943 in the Go standard library was addressed in init-known-hosts, oidc-service, permissions-service, runner-admin, server-license services.
• CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032 in golang.org/x/net was addressed in api-gateway, execution-gateway, machine-provisioner, oidc-tasks-service, output, step services.
• CVE-2026-46595, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, ciam-gateway, init-known-hosts, notifications, oidc-service, oidc-tasks-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, execution-gateway, machine-provisioner, oidc-service, output, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in authentication-svc, distributor, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, machine-provisioner, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2025-30153, CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595 in Netty (io.netty:netty-handler) was addressed in builds-service, circle-www-api, insights-service services.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-67213 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-84375 in js-yaml was addressed in web-ui service.
• CVE-2026-73088, CVE-2026-73089 in browserslist was addressed in web-ui service.
• CVE-2026-69153 in postcss was addressed in web-ui service.
• CVE-2026-71437 in mermaid was addressed in web-ui service.
• CVE-2026-63670, CVE-2026-84371 in sanitize-html was addressed in web-ui service.
• CVE-2026-8769 in @ai-sdk/provider-utils was addressed in web-ui service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-mongodb, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5968-e68a9d5 with the default registry settings. Then remove any kong.image overrides.
• Changed the default mongodb.image.tag, rabbitmq.image.tag and redis.image.tag values to rebuilt internal MongoDB, RabbitMQ and Redis images: MongoDB from 7.0.15-debian-12-r2 to 7.0.5967-e68a9d5, RabbitMQ from 3.12.4066-fcf0542 to 3.12.5969-e68a9d5, and Redis from 6.2.2471-c0995cc to 6.2.5966-e68a9d5. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set mongodb.image.tag to 7.0.5967-e68a9d5, rabbitmq.image.tag to 3.12.5969-e68a9d5 and redis.image.tag to 6.2.5966-e68a9d5, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• notifications
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-mongodb
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5968-e68a9d5), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See Configuration Changes Section.

Deprecated components

None.

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.7

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

Bug Fixes

• Fixed a crash loop on installs that keep tracing disabled (the default). Kubernetes service links injected a non-numeric OTEL_COLLECTOR_PORT value, which some services could not parse. The chart now always sets a numeric port, so these pods start without a workaround.
• Fixed the Insights CronJobs, which ran as the wrong user and failed with “Permission denied”. The hourly and daily Insights refresh jobs now complete.
• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to CircleCI cloud and to an endpoint that Server does not deploy. These requests failed silently, so no data reached either service. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-39822, CVE-2026-42505, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862 in the Go standard library was addressed in init-known-hosts, server-license services.
• CVE-2026-46600, CVE-2026-78659, CVE-2026-78660, CVE-2026-78661, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032, CVE-2026-97045 in golang.org/x/net was addressed in docker-provisioner, execution-gateway, machine-provisioner, no-op-job-provider, output, picard, step services.
• CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, distributor, machine-provisioner, no-op-job-provider, oidc-tasks-service, output, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, distributor, execution-gateway, lock-job-provider, no-op-job-provider, oidc-service, permissions-service, policy-service, public-api-service, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in distributor, execution-gateway, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-41579 in runc (github.com/opencontainers/runc) was addressed in docker-provisioner service.
• CVE-2026-5160 in goldmark (github.com/yuin/goldmark) was addressed in docker-provisioner service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595, CVE-2026-75596 in Netty (io.netty:netty-handler) was addressed in api-service service.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-64641, CVE-2026-64643, CVE-2026-64644, CVE-2026-64645, CVE-2026-64646, CVE-2026-64647, CVE-2026-64648, CVE-2026-64649, CVE-2026-75604, CVE-2026-96889 in Next.js (next) was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75899, CVE-2026-75975, CVE-2026-76172 in fast-uri was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-59869, CVE-2026-84375 in js-yaml was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-67213, CVE-2026-67214, CVE-2026-73086 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614 in @xmldom/xmldom was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-111755, CVE-2026-111756 in follow-redirects was addressed in web-ui-server-admin service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5976-281b064 with the default registry settings. Then remove any kong.image overrides.
• Changed the default rabbitmq.image.tag and redis.image.tag values to rebuilt internal RabbitMQ and Redis images: RabbitMQ from 3.12.4071-a535ab2 to 3.12.5977-281b064, and Redis from 6.2.2471-c0995cc to 6.2.5979-281b064. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set rabbitmq.image.tag to 3.12.5977-281b064 and redis.image.tag to 6.2.5979-281b064, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5976-281b064), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See the Configuration Changes Section.

Deprecated components

None.

Updates

• The NGINX default image has been updated to version 1.30.1, which addresses security vulnerabilities present in version 1.30.0 that were not resolved until after its release. No action is required unless you have pinned the NGINX image tag in your deployment.

• Pipeline creation failures caused by OAuth webhook setup now return specific error messages instead of generic failures, making it easier for operators and users to understand why a trigger could not be created.

• The new pipelines page toggle has been disabled for Server instances, as the new pipeline view is not available in Server deployments. This prevents users from encountering an unsupported UI state.

• Serial jobs that depend on multiple non-serial job groups now correctly resolve their dependencies at compilation time, preventing jobs from failing or behaving incorrectly due to misresolved dependency ordering.

• Nginx-to-Kong upstream connection keepalive pooling is now enabled, preventing ephemeral TCP port exhaustion and intermittent 502 errors that could occur under sustained load.

• The source config size limit has been removed for Server deployments, allowing pipelines that use large orb imports to be processed without hitting the previous 8 MB constraint.

• Editing context variables for account contexts is now handled correctly on Server, restoring a legacy code path that had been inadvertently broken.

New Features

• Kong now supports referencing an existing Kubernetes secret for Redis authentication credentials, in addition to plain-text passwords. This allows operators to manage Redis credentials more securely using standard Kubernetes secret management practices.

• Pod annotations can now be configured for the nomad-server deployment via Helm values, allowing operators to add custom annotations (for example, for Prometheus scraping) that persist across upgrades.

• Per-service nodeSelector overrides are now available in Helm values, allowing operators to constrain pod placement to specific nodes on a per-service basis rather than relying solely on a global nodeSelector.

• Per-service tolerations overrides are now available in Helm values, allowing operators to customize which node taints each service can tolerate independently of the global toleration settings.

• Per-service nodeAffinity overrides are now available in Helm values, allowing operators to customize pod affinity rules per service (such as preferring specific node pools) while a global default remains in effect.

• Per-service pod anti-affinity configuration is now available in Helm values for nomad-server, domain-service, and workflows-conductor-grpc, allowing operators to enforce or prefer pod distribution across nodes to reduce the risk of cascading failures.

• Windows AMI support has been added to the stable environment configuration, enabling self-hosted runner deployments that target Windows instances.

Bug Fixes

• Fixed a Helm templating error that prevented node tolerations from being rendered correctly in generated Kubernetes manifests.

CVE Fixes

• CVE-2026-33814 in golang.org/x/net was addressed in machine-provisioner service(s).

• CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, output, execution-gateway, step, notifications service(s).

• CVE-2026-42506 in golang.org/x/net was addressed in notifications, execution-gateway, output service(s).

• CVE-2026-34040 in docker module dependencies was addressed in docker-provisioner service(s).

• CVE-2026-40898 in quic-go was addressed in output, execution-gateway, distributor, step, machine-provisioner, oidc-tasks-service service(s).

• CVE-2026-5160 in goldmark was addressed in runner-admin, output, distributor, step service(s).

• CVE-2026-32282 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-39822 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-42505 in Go toolchain was addressed in permissions-service service(s).

• CVE-2026-41889 in pgx was addressed in authentication-svc, policy-service service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in output, runner-admin, step, execution-gateway, oidc-tasks-service service(s).

• CVE-2026-56852 in golang.org/x/text was addressed in machine-provisioner, ciam-gateway, authentication-svc, output, permissions-service, contexts-service, server service(s).

• GHSA-mpwr-8vm7-h73f in go-pkcs12 was addressed in contexts-service service(s).

• GHSA-hrxh-6v49-42gf in gRPC was addressed in distributor, public-api-service, output, policy-service, notifications, authentication-svc, runner-admin, docker-provisioner, execution-gateway, step, ciam-gateway, oidc-tasks-service, server service(s).

• CVE-2026-41178 in go.opentelemetry.io/otel was addressed in output, step, docker-provisioner, oidc-tasks-service, contexts-service, runner-admin, server service(s).

• CVE-2026-46625 in js-cookie and GHSA-39q2-94rc-95cp in dompurify were addressed in web-ui, web-ui-server-admin service(s).

• GHSA-259r-337f-4rfw in github.com/klauspost/compress was addressed in output service(s).

• CVE-2026-6790 in Eclipse Jetty was addressed in api-service service(s).

• CVE-2026-6473, CVE-2026-6475, CVE-2026-6476, CVE-2026-6477, CVE-2026-6479, CVE-2026-6637, CVE-2026-6638 in PostgreSQL were addressed in server-postgres service(s).

• GHSA-w9fj-cfpg-grvv and GHSA-pwqr-wmgm-9rr8 in Netty were addressed in insights-service, orb-service, workflows-conductor, cron-service, branch-service, api-service service(s).

Configuration Changes

• The builds-service JVM heap size is now configurable as a Helm value (builds-service.jvmHeapSize or equivalent chart key), giving operators direct control over memory allocation for this service. This is an optional setting; the previous default behaviour is preserved if not set.

• Authentication service rate limits (request thresholds and burst limits) are now configurable via Helm values, allowing operators to tune rate limiting to suit their environment instead of relying on hard-coded defaults. This is an optional setting.

• Resource requests and limits for all services are now configurable via values.yaml, replacing previously hardcoded values. Operators can now set appropriate resource requests to achieve the desired Kubernetes QoS class and tune limits per service, including Vault sidecar containers. This is an optional setting; existing defaults are preserved if not overridden.

Removed Components

• audit-log-service

Updates

• nginx upstream connections to Kong now use keepalive pooling to reuse TCP connections. This prevents ephemeral port exhaustion under high load, eliminating the 502 errors that could occur in busy deployments.

• A connection-pool defect in the Redis client used by the oidc-tasks-service has been resolved. OIDC token retrieval on Machine jobs no longer stalls due to exhausted or stuck pool connections.

New Features

• Each Kubernetes deployment now supports per-service nodeSelector overrides. Operators can schedule individual service pods onto specific node pools without changing global nodeSelector settings.

• Each Kubernetes deployment now supports per-service tolerations overrides. Operators can allow individual service pods to be scheduled onto tainted nodes without modifying global toleration configuration.

• Each Kubernetes deployment now supports per-service nodeAffinity overrides. Operators can control pod placement preferences for individual services independently of any global affinity rules.

CVE Fixes

• CVE-2026-56852 in golang.org/x/text was addressed in step, oidc-tasks-service service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in machine-provisioner, output service(s).

• CVE-2026-41178 in go.opentelemetry.io/otel was addressed in server, no-op-job-provider, step, oidc-tasks-service, authentication-svc service(s).

• CVE-2026-46625 in js-cookie and CVE-2026-24001 in diff were addressed in web-ui, web-ui-server-admin service(s).

• CVE-2026-5841 in github.com/klauspost/compress was addressed in step, lock-job-provider service(s).

• CVE-2026-53606 in sanitize-html was addressed in web-ui, web-ui-server-admin service(s).

Updates

• The source config size limit for orb imports has been removed for Server deployments. Pipelines that previously failed because their combined orb configuration exceeded the 6–8 MB threshold will now process successfully without any configuration changes.

• Insights-service database migration validation errors that occurred during upgrades have been fixed, allowing upgrades to complete cleanly without manual intervention.

• Fixed a security context user mismatch for the insights-service that could prevent the service from starting correctly in environments with strict pod security policies.

New Features

• Pod annotations on Nomad server deployments are now configurable via the Helm chart. Operators can set custom annotations (for example, to enable Prometheus scraping) without needing manual patches that would otherwise be lost on upgrade.

• A configurable prefix directory for Kong is now available, resolving socket permission errors that occurred in restricted or hardened environments.

Configuration Changes

• Authentication service rate limits are now configurable. Operators can tune API throttling behaviour by setting the relevant environment variables in their deployment. This is optional; existing deployments will continue to use the previous hardcoded defaults.

• Resource requests and limits for all application services are now fully configurable through values.yaml. This allows operators to set Guaranteed QoS, prevent OOM cascades, and right-size workloads for their infrastructure. Previously these values were hardcoded. This is optional but recommended for production deployments.

CVE Fixes

• CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, docker-provisioner, execution-gateway, step service(s).

• CVE-2026-33814 in golang.org/x/net was addressed in execution-gateway, api-gateway service(s).

• CVE-2026-42506 in golang.org/x/net was addressed in step, execution-gateway service(s).

• CVE-2026-29181 and CVE-2026-39883 in go.opentelemetry.io/otel were addressed in policy-service service(s).

• CVE-2026-34282 and CVE-2026-22016 in JDK were addressed in contexts-service, permissions-service service(s).

• CVE-2026-42010 and CVE-2026-33845 in libgnutls30 were addressed in server-rabbitmq service(s).

• CVE-2026-40898 in github.com/quic-go/quic-go was addressed in output, execution-gateway, distributor, no-op-job-provider, step, permissions-service, lock-job-provider, authentication-svc service(s).

• CVE-2026-39824 in golang.org/x/sys was addressed in output service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in docker-provisioner, machine-provisioner, output, step, oidc-tasks-service service(s).

• CVE-2026-33812 in golang.org/x/image was addressed in public-api-service service(s).

• CVE-2026-6321 and CVE-2026-6322 in fast-uri were addressed in web-ui, web-ui-server-admin service(s).

• CVE-2026-5160 in goldmark were addressed in distributor, step service(s).

• CVE-2026-47691 in netty-resolver-dns was addressed in domain-service service(s).

• CVE in Netty (including netty-handler) was addressed in contexts-service, permissions-service, orb-service, workflows-conductor, cron-service, api-service, branch-service, domain-service, insights-service service(s).

• CVE in google.golang.org/grpc (xDS RBAC authorization bypass and HTTP/2 vulnerabilities) was addressed in public-api-service, permissions-service, distributor, authentication-svc, ciam-gateway, runner-admin service(s).

• CVE in golang.org/x/text (infinite loop on invalid UTF-8 input) was addressed in no-op-job-provider, distributor, ciam-gateway, authentication-svc service(s).

• CVE-2025-69725 in go-chi was addressed in authentication-svc service(s).

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

Updates

• Fixed nginx ACM configuration to restrict SSL ports to 80 and 443, matching actual Service ports. This prevents AWS Load Balancer Controller reconciliation failures that could occur when invalid ports were specified.
• Refreshed AMIs for server 4.8 with Q2 2026 security updates and improvements for both standard AWS and GovCloud regions as well as GCP. These AMIs address the Copy Fail Vulnerability.
• Released an updated startup script in our server-terraform to address the Copy Fail Vulnerability. Please reference the corresponded 4.8.11 release in the server-terraform repository.
• Updated contexts-service security context user configuration to improve service security posture.
• Fixed various pathing issues in component templates which blocked customers from being able to set the replica number for some of our services.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in docker-provisioner service.
• CVE-2026-39883 in OpenTelemetry SDK was addressed in execution-gateway, machine-provisioner, distributor services.
• CVE-2026-33186 in gRPC was addressed in public-api-service, policy-service, permissions-service, oidc-service, ciam-gateway services.
• CVE-2026-34986 in go-jose was addressed in public-api-service, oidc-service, ciam-gateway, output services.
• CVE-2026-33816 in pgx was addressed in oidc-tasks-service, policy-service, permissions-service, machine-provisioner, distributor services.
• CVE-2025-13465 in lodash was addressed in web-ui-consolidated service.
• CVE-2026-33870 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33871 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33814 in golang.org/x/net was addressed in step, execution-gateway services.
• Updated default nginx unprivileged image tag to 1.30.1 to address the following CVEs: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946
• Updated RabbitMQ to fix known CVEs in the message broker component. This addresses security vulnerabilities in the messaging infrastructure.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.0

Updates

• Upgraded Nomad server to version 1.11.3, incorporating security fixes and performance improvements for job scheduling.
• Upgraded Nomad Autoscaler to 0.4.9, providing improved scaling control and reliability for VM auto-scaling.
• Increased Nomad server liveness probe tolerances to prevent unnecessary restarts during high-load periods while maintaining cluster health.
• Added automated liveness checks to GCP and AWS Nomad client machines that detect server IP changes and trigger automatic reconnection, eliminating silent job failures when the server is replaced.
• Migrated audit log functionality from a legacy service to the notifications service, streamlining maintenance and enabling S3 bucket export for audit logs.
• Updated machine image AMIs for AWS, GCP, and GovCloud regions to include latest security patches and system updates.
• Removed app. subdomain requirement for Circle Server UI access, simplifying deployment topology.
• Enabled gRPC client-side load balancing via headless Services. All internal gRPC paths now use Kubernetes Headless Service instead of ClusterIP, enabling proper client-side load balancing across replicas. This reduces hotspotting on large Server clusters.

New Features

• Added support for configurable SSH key algorithms (RSA, ECDSA, Ed25519) for deploy keys using the SSH_KEY_ALGORITHM environment variable, enabling FIPS 140-compliant environments and GovCloud deployments.
• It is now possible to delete Self-Hosted Runners resource classes directly in the Web UI, in the Runners inventory page. Customers can still do the same using CircleCI CLI.
• Added configuration options to customize CPU and memory resource requests and limits for internalized Nomad servers using nomad.server.resources.requests.cpu, nomad.server.resources.requests.memory, nomad.server.resources.limits.cpu, and nomad.server.resources.limits.memory values.
• Added Ubuntu 26.04 (ubuntu-2604) machine image support to EC2 image lists.
• RabbitMQ memory requests and limits are now exposed and configurable via your helm values.yaml.

Bug Fixes

• Fixed serial group deadlock when jobs have Unauthorized status by treating unauthorized as a terminal state for unlock job dependencies.
• Before, when users enabled the organization wide “Block all new work from starting for this organization” setting, it was still possible to bypass that when disabling the block at the project level using the “Block all new work from starting for this project” setting. This is now fixed and the organization level setting will not be bypassed anymore.
• Fixed runner resource class creation via the UI which was previously failing due to backend validation errors.
• Fixed NGINX AWS Certificate Manager configuration to ensure Load Balancer Controller ports match Service ports, resolving reconciliation failures.
• Fixed ‘project not found’ errors in workflow rerun handler to return proper NOT_FOUND status instead of UNKNOWN for deleted projects.
• Fixed job page UI jitter and step disclosure collapse during background updates, improving user experience when viewing running jobs.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in build-agent service.
• CVE-2026-34986 in go-jose library was addressed in oidc-tasks-service, public-api-service services.
• CVE-2026-33816 in pgx PostgreSQL driver was addressed in oidc-tasks-service, machine-provisioner, distributor, contexts-service services.
• CVE-2026-33814 in golang.org/x/net library was addressed in execution-gateway, docker-provisioner, output, distributor services.
• CVE-2026-45022 in go-git library was addressed in build-agent service.
• CVE-2026-45109 in Next.js was addressed in web-ui-server-admin service.

Configuration Changes

• MongoDB 7.0 is the default database image shipped with CircleCI Server 4.10.0 and above. MongoDB 4.4 has reached end of life and is no longer receiving security patches or updates from MongoDB, Inc. Customers must upgrade to MongoDB 7.0 before upgrading to server 4.10. Please use our mongo 7 upgrade script to upgrade the mongoDB in your CircleCI Server instance to 7.0.
• Implemented hard limit of 100 retries per workflow to prevent abuse. This limit is automatically enforced and cannot be configured.
• The trigger_parameters field in the pipeline values has been deprecated in favour of pipeline VCS fields. Customers should upgrade their integrations to use the new VCS field structure for pipeline triggers.
• Migrated to OpenTelemetry collector; removed Telegraf collector. Updated related configuration and deployment templates.

New Components

• notifications

Deprecated Components

• audit-log-service

Note

This is the last update for Server 4.7 as it has reached end of life. Please upgrade to Server 4.8.x.

Fixes

• Updated the IMDS client in machine-agent to fallback to IMDSv1 if it can’t communicate with IMDSv2
• Fixed incorrect kong HTTP header
• Fixed a bug where failed pipelines would produce an url that points to circleci.com rather than the CircleCI Server’s domain
• Fix for intermittent “S3 ExpiredToken” errors which occurred during workspace uploads for jobs running longer than 15 minutes

Image Updates

• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• circle-www-api
• cron-service
• cron-service-migrator
• domain-service
• domain-service-migrator
• init-known-hosts
• machine-provisioner
• machine-provisioner-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• policy-service
• runner-admin
• runner-admin-migrator
• server-postgres
• server-rabbitmq
• server-redis
• web-ui
• web-ui-authentication
• web-ui-insights
• web-ui-onboarding
• workflows-conductor
• workflows-conductor-migrator

Server 4.9.0 Changelog

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.0

The v4.9 release introduces serial groups for job serialization, automatic retries for workflows and steps, and improved caching with Zstd compression. In addition, MongoDB 4.4 or higher is required before upgrading to v4.9.

NEW FEATURES

• Serial Groups: A native mechanism for serializing job execution across workflows. Jobs can now be configured to run sequentially using the serial-group key, preventing race conditions in deployments and other concurrent operations. For more information, see the docs.

• Automatic Workflow Reruns: Workflows can now be configured to automatically rerun on failure using the max_auto_reruns configuration key. For more information, see the changelog.

• Automatic Step Retries: Individual steps within jobs can now be configured to automatically retry on failure. For more information, see the changelog.

• Faster Checkout with Blobless Method: The checkout step now supports a method option that enables blobless checkout for faster repository cloning. For more information, see the changelog.

• Zstd Cache Compression: Cache compression now uses Zstd by default, providing faster compression and decompression with better compression ratios. For more information, see the changelog.

• Job-level Cache Retention Controls: Cache retention can now be configured at the job level, allowing more granular control over cache lifecycle. For more information, see the changelog.

• OIDC Token Reliability Improvements: Enhanced retry handling for OIDC token generation, improving reliability in environments with transient network issues. For more information, see the changelog.

• Configurable Max Run Time: Build jobs now support a configurable maximum run time through the builds_service.custom_max_run_time Helm value, allowing operators to override the default 5-hour limit.

• Dark Mode: Users can now enable “Dark mode” through the CircleCI web app, see the changelog.

CHANGES

• Some CircleCI job statuses that were previously marked as skipped were changed to failed, see the changelog.
• Reduced time to start jobs for very large and complex workflows, see the changelog.
• Personal Access Token (PAT) management has been migrated to the authentication-service. PATs are automatically migrated during the upgrade process. This changes requires that the mongoDB instance used by your CircleCI server is at least MongoDB 4.4. You will need to upgrade your mongoDB instance before upgrading to server 4.9.0. Please reference our MongoDB Upgrade instructions if your mongoDB instance is not externalized.
• Context APIs are now served by the CIAM gateway for improved performance and scalability.
• Redis has been updated to the version 6.2.20 to address CVE-2025-49844.
• The feature-flags service has been removed as it is not required for Server installations.
• Deleting contexts double confirmation now asks for the name of the context, see the changelog.
• Branches now displayed in branch picker regardless of trigger settings, see the the changelog.
• Workflow start time & duration are now copyable from CircleCI web app, see the changelog.
• URL Addressable Orbs - Removes the barriers to reusable config by allowing any file in your VCS to become a CircleCI orb. Allowlist rules maintain security and compliance, see the documentation.

BUG FIXES

• Fixed incorrect trigger event display for scheduled workflows. For more information, see the changelog.
• Fixed an issue where pipelines showed errors when all workflows are filtered out. For more information, see the changelog.
• Fixed branch filter dropdown functionality. For more information, see the changelog.
• Fixed project count on “User homepage”, see the changelog.

NEW SERVICES

New services introduced with this release:

• lock-job-provider - Provides job serialization capabilities for serial groups feature (includes internalapi and consumer components)
• no-op-job-provider - Handles no-operation job types used by serial groups

SERVICE CHANGES

• feature-flags - The feature flags service has been removed as it is not utilized by execution services in Server.

DATABASE MIGRATIONS

The following databases will run migrations when upgrading to this version:

• authentication-service
• insights-service
• lock-job-provider
• no-op-job-provider
• oidc-tasks-service
• permissions-service
• runner-admin

KNOWN ISSUES

Using a custom signed certificate will result in an x509 error for Docker, Machine, and Runner jobs. A fix will be provided shortly in the future.

MongoDB 4.4 is the default database image shipped with CircleCI Server 4.9.1 and above. However, MongoDB 4.4 has reached end of life and is no longer receiving security patches or updates from MongoDB, Inc. Please use our mongo 7 upgrade script to upgrade the mongoDB in your CircleCI Server instance to 7.0. If you have mongoDB 3.6 deployed in your cluster, you will first need to upgrade to mongoDB 4.4 using our mongo 4 upgrade script, before upgrading to mongoDB 7.0.

To learn more about Server 4.9 installation, migration, or operations please review our documentation.

Updates

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

• postgresql
• mongodb
• redis
• rabbitmq

Image Updates

The following images have moved from Bitnami-hosted to CircleCI-hosted:

• mongodb
• redis

The following images have been updated since 4.8.1:

• webhook-service
• permissions-service
• domain-service
• orb-service
• policy-service
• web-ui-server-admin
• branch-service
• authentication-svc
• workflows-conductor
• builds-service
• cron-service

NOTE

Please note this release has been marked as broken and should not applied. Fixes will be applied in the 4.7.8 patch.

Updates

• Enable Redis permissions cache in server
• Stopped sending duplicate execution-engine-config-str spec to WFC, reducing message size by up to 15 MB for large customer configs

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• The authentication process now correctly utilizes a cache for JWT.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed
• Addressed CVEs in authentication-service, api-service and web-ui services

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

• postgresql
• mongodb
• redis
• rabbitmq

Image Updates

The following images have moved from Bitnami-hosted to CircleCI-hosted:

• mongodb
• redis

The following images have been updated since 4.7.6:

• postgres
• rabbitmq
• web-ui-onboarding
• web-ui-org-settings
• cron-service
• web-ui-insights
• web-ui
• ciam-gateway
• branch-service
• web-ui-authentication
• workflows-conductor
• authentication-svc
• api-service
• runner-admin
• domain-service
• policy-service
• builds-service

Server 4.8.0 Changelog

Before Upgrading

See the CircleCI server 4.8 release notes and upgrade guide for this release.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.8.0

The v4.8 release introduces further security improvements and support for flexible job dependencies.

NEW FEATURES

• Nomad UI is now accessible.
• Amazon Message Queue (AMQ) is now supported.
• Added support for configuring IOPS and throughput parameters for EC2 instances in the machine provisioner. New parameters can be found in the values.yaml reference.
• CircleCI Server now supports nomad servers externalized from your Kubernetes cluster. You may now deploy nomad servers on your own VM instances. This should improve the performance and stability of your nomad clusters.
• Support for Expression-based job filters
• Support for flexible job dependency.
• Support for Dynamic When Statements for Workflows (Breaking Change)
• Support for Windows container runner preview

NEW SERVICE:

• public-api-service

REMOVALS:

• web-ui-user-settings
• web-ui-org-settings
• web-ui-insights
• web-ui-project-settings
• web-ui-runners
• Support for launch-agent.
• Already-disabled v2 runner API endpoints.

CHANGES

• Moved from CircleCI fork back to upstream Hashicorp Nomad for improved stability and security updates.
• Nomad clients require IPv6 support within the kernel.
• JSON logging is enabled for Clojure services. This change allows customers to ingest logs from these services to their log aggregators in a familiar and consistent format.
• All containers now run with runAsNonRoot: true
• Telegraf will now include circleci_server_version in all the metrics it collects.
• The frontend container now uses the circleci-www-api image instead of the previously named frontend image.
• Clojure containers have moved to Java 21.
• Kong has been updated to 3.4.2
• Rerun workflow endpoint now has a rate limit of 20 requests per 5 seconds (max burst: 10)
• In server-terraform, the included Nomad images are now based on Ubuntu 22.04 with CgroupsV1 enabled. CgroupsV2 is currently unsupported. These nomad AMIs are built automatic security updates enabled.

PERFORMANCE IMPROVEMENTS:

• Database Operations: Optimized workflow storage to avoid N+1 database queries, reducing latency and improving concurrency.
• Workflow Status API: Now uses stored workflow status instead of generating it from job data, improving response times.
• Compiled Config Size: Removed unused job definitions from compiled configs, reducing size for customers with large configurations.

BUG FIXES

• Expression based restrictions via API have been fixed.
• Job handlers no longer silently drop on partial failure.
• Fixed broken branch picker functionality.
• SSH reruns in air-gapped installs have been restored.
• Broken pipelines now show triggering information in the UI.

DATABASE MIGRATIONS

The following services will run migrations when upgrading to this version:

• workflows-conductor
• authentication-svc
• builds-service
• branch-service
• contexts-service
• cron-service
• distributor
• domain-service
• insights-service
• machine-provisioner
• orb-service
• permissions-service
• runner-admin

NOTES

Customers that are using “S3-compatible” object storage should ensure that their object storage supports S3’s default data integrity protections. This includes (but is not limited to) Minio RELEASE.2025-01-20T14-49-07Z and Nutanix Objects v5.1.1.

KNOWN ISSUES

• Docker jobs may take an extra 60 seconds to conclude under certain circumstances.
• RDS is not compatible due to certain permissions checks; this will be fixed in 4.8.1.
• Vault may not refresh its client token after a month of uptime. Migrate to Tink to resolve this issue.
• Retry with SSH for jobs using the machine executor advertises a private IP address. For this reason, retry with SSH for jobs using the machine executor works as standard for public installations, but for private installs you would need to ensure that you can access the private IP advertised. For example, by using a VPN into your VPC.
• Machine builds using instances with IMDSv1 enabled is not supported

To learn more about Server 4.8 installation, migration, or operations please review our documentation.