Changelog

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new NGINX image before you upgrade. See Configuration Changes below.

If you create your Nomad clients with the nomad-aws or nomad-gcp modules from server-terraform, the 4.9.8 module defaults move your Nomad clients to Ubuntu 24.04 when you update the module version. See details below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.8

Updates

The default Linux VM images for Machine Provisioner and remote Docker jobs were updated in all regions for AWS (including GovCloud) and GCP. If you set machine_provisioner.providers.ec2.linuxAMI or machine_provisioner.providers.gcp.linuxImage, your own image stays in use for x86 Linux jobs.

Nomad client images now based on Ubuntu 24.04

We are publishing new images for AWS and GCP customers to address CVE-2026-98432 and CVE-2026-99999 in the Linux kernel.

Important: The new Nomad client images are now based on Ubuntu 24.04 instead of Ubuntu 22.04.

For AWS

The nomad-aws module in server-terraform now uses the CircleCI Server Nomad AMI for Ubuntu 24.04 by default. The default of machine_image_names changed from ["CircleCIServerNomad*"] (Ubuntu 22.04) to ["ServerNomadV2-*"]. The new AMI has Linux kernel 6.8.0-1069 with the fixes for CVEs mentioned above.

The default applies to the Nomad clients. It also applies to the Nomad servers when you set deploy_nomad_server_instances to true. The client startup script now installs the Docker package that matches the Ubuntu release, so it works on 22.04 and 24.04 AMIs.

For GCP

The nomad-gcp module in server-terraform now boots Nomad clients from the CircleCI Server Nomad client image for GCP by default. The default of machine_image_project changed from ubuntu-os-cloud to circleci-images. The default of machine_image_family changed from ubuntu-2204-lts to circleci-server-nomad-image-2404, which stores the image in the us multi-region.

The image has Ubuntu 24.04, Linux kernel linux-gcp 6.8.0-1073. Two regional families have the same image: circleci-server-nomad-image-2404-us-central1 and circleci-server-nomad-image-2404-us-east1.

The client startup script now supports images that already boot with cgroup v1 enabled (required for Docker), and it installs the Docker package that matches the Ubuntu release.

Action: if your organization uses the GCP compute.trustedImageProjects policy, allow projects/circleci-images.

Bug Fixes

• Fixed Docker layer caching (DLC) on machine images that use the containerd image store, such as images with Docker 29. A restored cache marked build steps as CACHED while their image layers were missing, and the job failed with “failed to get reader from content store”. DLC now supports the containerd image store, so restored caches work again.
• Fixed the pipeline values of builds that the v1 and v1.1 APIs trigger with a config override. These builds had pipeline.config_source set to vcs and also had the config repository values. Their OIDC tokens then said that the config came from the repository. Now pipeline.config_source is api and the config repository values are not set, so the OIDC config claims are correct. If your OIDC trust policies use the config claims for these builds, review them.

CVE Fixes

• CVE-2026-116587 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in authentication-svc, ciam-gateway, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, public-api-service, step services.
• CVE-2026-78661, CVE-2026-97045 in golang.org/x/net was addressed in api-gateway, authentication-svc, ciam-gateway, distributor, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-116591 in compress (github.com/klauspost/compress) was addressed in authentication-svc, distributor, lock-job-provider, permissions-service, picard services.
• CVE-2026-63670, CVE-2026-84371, CVE-2026-113650, CVE-2026-113654, CVE-2026-113661 in sanitize-html was addressed in web-ui service.
• CVE-2023-54404 in Zod (zod) was addressed in web-ui service.
• CVE-2026-67313, CVE-2026-67315, CVE-2026-67319, CVE-2026-67320, CVE-2026-67321 in Axios (axios) was addressed in web-ui-server-admin service.
• CVE-2026-118664 in decode-uri-component was addressed in web-ui-server-admin service.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in server-nginx service and in the nomad-gcp Nomad client image.

Configuration Changes

NGINX now runs a CircleCI-maintained NGINX image from the CircleCI registry instead of the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. We made this change so that we can patch the NGINX image quickly, for example, for the Node2Shell vulnerability (CVE-2026-111497) in libbrotli1.

The new image is built on nginx/nginx-unprivileged 1.31.8, so NGINX moves from 1.30.1 to 1.31.8.

The nginx.image.repository and nginx.image.tag values are removed. The chart ignores them and builds the NGINX image path from global.container.registry and global.container.org, like other CircleCI images.

Action: If you mirror images for an air-gapped or private-registry install, mirror the server-nginx image too: cciserver.azurecr.io/server-nginx:1.31.6053-5b58edb with the default registry settings. Then remove any nginx.image overrides.

Service changes

New components

server-nginx: the CircleCI-built NGINX image (circleci/server-nginx:1.31.6053-5b58edb), new in images.yaml in this release. It replaces the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. NGINX already ran before, so the change is described under Configuration Changes above.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• distributor
• distributor-migrator
• domain-service
• domain-service-migrator
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• web-ui-server-admin
• workflows-conductor
• workflows-conductor-migrator

Deprecated components

None.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new NGINX image before you upgrade. See Configuration Changes below.

If you create your Nomad clients with the nomad-aws or nomad-gcp modules from server-terraform, the 4.10.3 module defaults move your Nomad clients to Ubuntu 24.04 when you update the module version. See details below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.3

Updates

The default Linux VM images for Machine Provisioner and remote Docker jobs were updated in all regions for AWS (including GovCloud) and GCP. If you set machine_provisioner.providers.ec2.linuxAMI or machine_provisioner.providers.gcp.linuxImage, your own image stays in use for x86 Linux jobs.

Nomad client images now based on Ubuntu 24.04

We are publishing new images for AWS and GCP customers to address CVE-2026-98432 and CVE-2026-99999 in the Linux kernel.

Important: The new Nomad client images are now based on Ubuntu 24.04 instead of Ubuntu 22.04.

For AWS

The nomad-aws module in server-terraform now uses the CircleCI Server Nomad AMI for Ubuntu 24.04 by default. The default of machine_image_names changes from ["CircleCIServerNomad*"] (Ubuntu 22.04) to ["ServerNomadV2-*"]. The new AMI has Linux kernel 6.8.0-1069 with the fixes for CVEs mentioned above.

The default applies to the Docker Nomad clients. It also applies to the Nomad servers when you set deploy_nomad_server_instances to true. Podman clients (use_podman set to true) do not change: they still use machine_image_names_podman. The client startup script now installs the Docker package that matches the Ubuntu release, so it works on 22.04 and 24.04 AMIs.

For GCP

The nomad-gcp module in server-terraform now boots Nomad clients from the CircleCI Server Nomad client image for GCP by default. The default of machine_image_project changes from ubuntu-os-cloud to circleci-images. The default of machine_image_family changes from ubuntu-2204-lts to circleci-server-nomad-image-2404, which stores the image in the us multi-region.

The image has Ubuntu 24.04, Linux kernel linux-gcp 6.8.0-1073. Two regional families have the same image: circleci-server-nomad-image-2404-us-central1 and circleci-server-nomad-image-2404-us-east1.

The client startup script now supports images that already boot with cgroup v1 enabled (required for Docker), and it installs the Docker package that matches the Ubuntu release.

Action: if your organization uses the GCP compute.trustedImageProjects policy, allow projects/circleci-images.

Bug Fixes

• Fixed Docker layer caching (DLC) on machine images that use the containerd image store, such as images with Docker 29. A restored cache marked build steps as CACHED while their image layers were missing, and the job failed with “failed to get reader from content store”. DLC now supports the containerd image store, so restored caches work again.
• Fixed the job Artifacts tab, which hid the artifacts of jobs older than 30 days even when object_storage.expireAfter was 0 (the default) or another value. The tab showed the message that artifacts expire after 30 days, although the artifacts were still in object storage. The tab now uses object_storage.expireAfter again: with 0 it does not hide artifacts, and with another value it hides them after that number of days.
• Fixed the pipeline values of builds that the v1 and v1.1 APIs trigger with a config override. These builds had pipeline.config_source set to vcs and also had the config repository values. Their OIDC tokens then said that the config came from the repository. Now pipeline.config_source is api and the config repository values are not set, so the OIDC config claims are correct. If your OIDC trust policies use the config claims for these builds, review them.

CVE Fixes

• CVE-2026-116587 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in authentication-svc, ciam-gateway, contexts-service, docker-provisioner, execution-gateway, lock-job-provider, no-op-job-provider, notifications, oidc-service, oidc-tasks-service, output, permissions-service, picard, policy-service, public-api-service, step services.
• CVE-2026-116585, CVE-2026-116586 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in contexts-service service.
• CVE-2026-78661, CVE-2026-97045 in golang.org/x/net was addressed in api-gateway, authentication-svc, ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, oidc-tasks-service, output, permissions-service, picard, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-116591 in compress (github.com/klauspost/compress) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, step services.
• CVE-2026-68497, CVE-2026-89407, CVE-2026-89425, CVE-2026-91776, CVE-2026-91777 in Jackson (jackson-core and jackson-databind) was addressed in builds-service service.
• CVE-2026-19204 in Jetty WebSocket (jetty-websocket-core-common) was addressed in builds-service, orb-service, workflows-conductor services.
• CVE-2023-54404 in Zod (zod) was addressed in web-ui service.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in server-nginx service and in the nomad-gcp Nomad client image.
• CVE-2026-98432, CVE-2026-99999 in the Linux kernel was addressed in the nomad-aws and nomad-gcp Nomad client images.

Configuration Changes

NGINX now runs a CircleCI-maintained NGINX image from the CircleCI registry instead of the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. We made this change so that we can patch the NGINX image quickly, for example, for the Node2Shell vulnerability (CVE-2026-111497) in libbrotli1.

The new image is built on nginx/nginx-unprivileged 1.31.8, so NGINX moves from 1.30.1 to 1.31.8.

The nginx.image.repository and nginx.image.tag values are removed. The chart ignores them and builds the NGINX image path from global.container.registry and global.container.org, like other CircleCI images.

Action: If you mirror images for an air-gapped or private-registry install, mirror the server-nginx image too: cciserver.azurecr.io/server-nginx:1.31.6046-c0318cf with the default registry settings. Then remove any nginx.image overrides.

Service changes

New components

server-nginx: the CircleCI-built NGINX image (circleci/server-nginx:1.31.6046-c0318cf), new in images.yaml in this release. It replaces the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. NGINX already ran before, so the change is described under Configuration Changes above.

Component Updates

• api-gateway
• approval-job-provider-migrator
• authentication-svc
• authentication-svc-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• notifications
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• workflows-conductor
• workflows-conductor-migrator

Deprecated components

None.

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.2

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

Bug Fixes

• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed orb import for site administrators, which failed with an authorization error. A failed downstream lookup during a permission check no longer stops the whole check.
• Fixed context permission checks on Server. Users can edit context environment variables and run jobs that use a context without an organization check that does not apply to Server.
• Fixed the project settings overview page, which showed a Not Found error. The page no longer calls an extra organizations endpoint to decide if the user is an admin.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to an endpoint that Server does not deploy, or to CircleCI cloud on an install without a configured hostname. These requests failed silently, so no data reached either service and no data was ever shared with CircleCI. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56857, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032, CVE-2026-111943 in the Go standard library was addressed in init-known-hosts, oidc-service, permissions-service, runner-admin, server-license services.
• CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032 in golang.org/x/net was addressed in api-gateway, execution-gateway, machine-provisioner, oidc-tasks-service, output, step services.
• CVE-2026-46595, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, ciam-gateway, init-known-hosts, notifications, oidc-service, oidc-tasks-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, execution-gateway, machine-provisioner, oidc-service, output, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in authentication-svc, distributor, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, machine-provisioner, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2025-30153, CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595 in Netty (io.netty:netty-handler) was addressed in builds-service, circle-www-api, insights-service services.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-67213 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-84375 in js-yaml was addressed in web-ui service.
• CVE-2026-73088, CVE-2026-73089 in browserslist was addressed in web-ui service.
• CVE-2026-69153 in postcss was addressed in web-ui service.
• CVE-2026-71437 in mermaid was addressed in web-ui service.
• CVE-2026-63670, CVE-2026-84371 in sanitize-html was addressed in web-ui service.
• CVE-2026-8769 in @ai-sdk/provider-utils was addressed in web-ui service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-mongodb, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5968-e68a9d5 with the default registry settings. Then remove any kong.image overrides.
• Changed the default mongodb.image.tag, rabbitmq.image.tag and redis.image.tag values to rebuilt internal MongoDB, RabbitMQ and Redis images: MongoDB from 7.0.15-debian-12-r2 to 7.0.5967-e68a9d5, RabbitMQ from 3.12.4066-fcf0542 to 3.12.5969-e68a9d5, and Redis from 6.2.2471-c0995cc to 6.2.5966-e68a9d5. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set mongodb.image.tag to 7.0.5967-e68a9d5, rabbitmq.image.tag to 3.12.5969-e68a9d5 and redis.image.tag to 6.2.5966-e68a9d5, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• notifications
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-mongodb
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5968-e68a9d5), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See Configuration Changes Section.

Deprecated components

None.

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.7

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

Bug Fixes

• Fixed a crash loop on installs that keep tracing disabled (the default). Kubernetes service links injected a non-numeric OTEL_COLLECTOR_PORT value, which some services could not parse. The chart now always sets a numeric port, so these pods start without a workaround.
• Fixed the Insights CronJobs, which ran as the wrong user and failed with “Permission denied”. The hourly and daily Insights refresh jobs now complete.
• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to CircleCI cloud and to an endpoint that Server does not deploy. These requests failed silently, so no data reached either service. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-39822, CVE-2026-42505, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862 in the Go standard library was addressed in init-known-hosts, server-license services.
• CVE-2026-46600, CVE-2026-78659, CVE-2026-78660, CVE-2026-78661, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032, CVE-2026-97045 in golang.org/x/net was addressed in docker-provisioner, execution-gateway, machine-provisioner, no-op-job-provider, output, picard, step services.
• CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, distributor, machine-provisioner, no-op-job-provider, oidc-tasks-service, output, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, distributor, execution-gateway, lock-job-provider, no-op-job-provider, oidc-service, permissions-service, policy-service, public-api-service, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in distributor, execution-gateway, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-41579 in runc (github.com/opencontainers/runc) was addressed in docker-provisioner service.
• CVE-2026-5160 in goldmark (github.com/yuin/goldmark) was addressed in docker-provisioner service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595, CVE-2026-75596 in Netty (io.netty:netty-handler) was addressed in api-service service.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-64641, CVE-2026-64643, CVE-2026-64644, CVE-2026-64645, CVE-2026-64646, CVE-2026-64647, CVE-2026-64648, CVE-2026-64649, CVE-2026-75604, CVE-2026-96889 in Next.js (next) was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75899, CVE-2026-75975, CVE-2026-76172 in fast-uri was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-59869, CVE-2026-84375 in js-yaml was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-67213, CVE-2026-67214, CVE-2026-73086 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614 in @xmldom/xmldom was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-111755, CVE-2026-111756 in follow-redirects was addressed in web-ui-server-admin service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5976-281b064 with the default registry settings. Then remove any kong.image overrides.
• Changed the default rabbitmq.image.tag and redis.image.tag values to rebuilt internal RabbitMQ and Redis images: RabbitMQ from 3.12.4071-a535ab2 to 3.12.5977-281b064, and Redis from 6.2.2471-c0995cc to 6.2.5979-281b064. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set rabbitmq.image.tag to 3.12.5977-281b064 and redis.image.tag to 6.2.5979-281b064, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5976-281b064), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See the Configuration Changes Section.

Deprecated components

None.

Updates

• The NGINX default image has been updated to version 1.30.1, which addresses security vulnerabilities present in version 1.30.0 that were not resolved until after its release. No action is required unless you have pinned the NGINX image tag in your deployment.

• Pipeline creation failures caused by OAuth webhook setup now return specific error messages instead of generic failures, making it easier for operators and users to understand why a trigger could not be created.

• The new pipelines page toggle has been disabled for Server instances, as the new pipeline view is not available in Server deployments. This prevents users from encountering an unsupported UI state.

• Serial jobs that depend on multiple non-serial job groups now correctly resolve their dependencies at compilation time, preventing jobs from failing or behaving incorrectly due to misresolved dependency ordering.

• Nginx-to-Kong upstream connection keepalive pooling is now enabled, preventing ephemeral TCP port exhaustion and intermittent 502 errors that could occur under sustained load.

• The source config size limit has been removed for Server deployments, allowing pipelines that use large orb imports to be processed without hitting the previous 8 MB constraint.

• Editing context variables for account contexts is now handled correctly on Server, restoring a legacy code path that had been inadvertently broken.

New Features

• Kong now supports referencing an existing Kubernetes secret for Redis authentication credentials, in addition to plain-text passwords. This allows operators to manage Redis credentials more securely using standard Kubernetes secret management practices.

• Pod annotations can now be configured for the nomad-server deployment via Helm values, allowing operators to add custom annotations (for example, for Prometheus scraping) that persist across upgrades.

• Per-service nodeSelector overrides are now available in Helm values, allowing operators to constrain pod placement to specific nodes on a per-service basis rather than relying solely on a global nodeSelector.

• Per-service tolerations overrides are now available in Helm values, allowing operators to customize which node taints each service can tolerate independently of the global toleration settings.

• Per-service nodeAffinity overrides are now available in Helm values, allowing operators to customize pod affinity rules per service (such as preferring specific node pools) while a global default remains in effect.

• Per-service pod anti-affinity configuration is now available in Helm values for nomad-server, domain-service, and workflows-conductor-grpc, allowing operators to enforce or prefer pod distribution across nodes to reduce the risk of cascading failures.

• Windows AMI support has been added to the stable environment configuration, enabling self-hosted runner deployments that target Windows instances.

Bug Fixes

• Fixed a Helm templating error that prevented node tolerations from being rendered correctly in generated Kubernetes manifests.

CVE Fixes

• CVE-2026-33814 in golang.org/x/net was addressed in machine-provisioner service(s).

• CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, output, execution-gateway, step, notifications service(s).

• CVE-2026-42506 in golang.org/x/net was addressed in notifications, execution-gateway, output service(s).

• CVE-2026-34040 in docker module dependencies was addressed in docker-provisioner service(s).

• CVE-2026-40898 in quic-go was addressed in output, execution-gateway, distributor, step, machine-provisioner, oidc-tasks-service service(s).

• CVE-2026-5160 in goldmark was addressed in runner-admin, output, distributor, step service(s).

• CVE-2026-32282 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-39822 in Go toolchain was addressed in permissions-service, server service(s).

• CVE-2026-42505 in Go toolchain was addressed in permissions-service service(s).

• CVE-2026-41889 in pgx was addressed in authentication-svc, policy-service service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in output, runner-admin, step, execution-gateway, oidc-tasks-service service(s).

• CVE-2026-56852 in golang.org/x/text was addressed in machine-provisioner, ciam-gateway, authentication-svc, output, permissions-service, contexts-service, server service(s).

• GHSA-mpwr-8vm7-h73f in go-pkcs12 was addressed in contexts-service service(s).

• GHSA-hrxh-6v49-42gf in gRPC was addressed in distributor, public-api-service, output, policy-service, notifications, authentication-svc, runner-admin, docker-provisioner, execution-gateway, step, ciam-gateway, oidc-tasks-service, server service(s).

• CVE-2026-41178 in go.opentelemetry.io/otel was addressed in output, step, docker-provisioner, oidc-tasks-service, contexts-service, runner-admin, server service(s).

• CVE-2026-46625 in js-cookie and GHSA-39q2-94rc-95cp in dompurify were addressed in web-ui, web-ui-server-admin service(s).

• GHSA-259r-337f-4rfw in github.com/klauspost/compress was addressed in output service(s).

• CVE-2026-6790 in Eclipse Jetty was addressed in api-service service(s).

• CVE-2026-6473, CVE-2026-6475, CVE-2026-6476, CVE-2026-6477, CVE-2026-6479, CVE-2026-6637, CVE-2026-6638 in PostgreSQL were addressed in server-postgres service(s).

• GHSA-w9fj-cfpg-grvv and GHSA-pwqr-wmgm-9rr8 in Netty were addressed in insights-service, orb-service, workflows-conductor, cron-service, branch-service, api-service service(s).

Configuration Changes

• The builds-service JVM heap size is now configurable as a Helm value (builds-service.jvmHeapSize or equivalent chart key), giving operators direct control over memory allocation for this service. This is an optional setting; the previous default behaviour is preserved if not set.

• Authentication service rate limits (request thresholds and burst limits) are now configurable via Helm values, allowing operators to tune rate limiting to suit their environment instead of relying on hard-coded defaults. This is an optional setting.

• Resource requests and limits for all services are now configurable via values.yaml, replacing previously hardcoded values. Operators can now set appropriate resource requests to achieve the desired Kubernetes QoS class and tune limits per service, including Vault sidecar containers. This is an optional setting; existing defaults are preserved if not overridden.

Removed Components

• audit-log-service

Updates

• The source config size limit for orb imports has been removed for Server deployments. Pipelines that previously failed because their combined orb configuration exceeded the 6–8 MB threshold will now process successfully without any configuration changes.

• Insights-service database migration validation errors that occurred during upgrades have been fixed, allowing upgrades to complete cleanly without manual intervention.

• Fixed a security context user mismatch for the insights-service that could prevent the service from starting correctly in environments with strict pod security policies.

New Features

• Pod annotations on Nomad server deployments are now configurable via the Helm chart. Operators can set custom annotations (for example, to enable Prometheus scraping) without needing manual patches that would otherwise be lost on upgrade.

• A configurable prefix directory for Kong is now available, resolving socket permission errors that occurred in restricted or hardened environments.

Configuration Changes

• Authentication service rate limits are now configurable. Operators can tune API throttling behaviour by setting the relevant environment variables in their deployment. This is optional; existing deployments will continue to use the previous hardcoded defaults.

• Resource requests and limits for all application services are now fully configurable through values.yaml. This allows operators to set Guaranteed QoS, prevent OOM cascades, and right-size workloads for their infrastructure. Previously these values were hardcoded. This is optional but recommended for production deployments.

CVE Fixes

• CVE-2026-39833 in golang.org/x/crypto was addressed in distributor, docker-provisioner, execution-gateway, step service(s).

• CVE-2026-33814 in golang.org/x/net was addressed in execution-gateway, api-gateway service(s).

• CVE-2026-42506 in golang.org/x/net was addressed in step, execution-gateway service(s).

• CVE-2026-29181 and CVE-2026-39883 in go.opentelemetry.io/otel were addressed in policy-service service(s).

• CVE-2026-34282 and CVE-2026-22016 in JDK were addressed in contexts-service, permissions-service service(s).

• CVE-2026-42010 and CVE-2026-33845 in libgnutls30 were addressed in server-rabbitmq service(s).

• CVE-2026-40898 in github.com/quic-go/quic-go was addressed in output, execution-gateway, distributor, no-op-job-provider, step, permissions-service, lock-job-provider, authentication-svc service(s).

• CVE-2026-39824 in golang.org/x/sys was addressed in output service(s).

• CVE-2026-46600 in golang.org/x/net was addressed in docker-provisioner, machine-provisioner, output, step, oidc-tasks-service service(s).

• CVE-2026-33812 in golang.org/x/image was addressed in public-api-service service(s).

• CVE-2026-6321 and CVE-2026-6322 in fast-uri were addressed in web-ui, web-ui-server-admin service(s).

• CVE-2026-5160 in goldmark were addressed in distributor, step service(s).

• CVE-2026-47691 in netty-resolver-dns was addressed in domain-service service(s).

• CVE in Netty (including netty-handler) was addressed in contexts-service, permissions-service, orb-service, workflows-conductor, cron-service, api-service, branch-service, domain-service, insights-service service(s).

• CVE in google.golang.org/grpc (xDS RBAC authorization bypass and HTTP/2 vulnerabilities) was addressed in public-api-service, permissions-service, distributor, authentication-svc, ciam-gateway, runner-admin service(s).

• CVE in golang.org/x/text (infinite loop on invalid UTF-8 input) was addressed in no-op-job-provider, distributor, ciam-gateway, authentication-svc service(s).

• CVE-2025-69725 in go-chi was addressed in authentication-svc service(s).

NOTE: This is the last patch for server 4.8 as it has now reached end of life. Please upgrade to a supported version.

Updates

• Fixed nginx ACM configuration to restrict SSL ports to 80 and 443, matching actual Service ports. This prevents AWS Load Balancer Controller reconciliation failures that could occur when invalid ports were specified.
• Refreshed AMIs for server 4.8 with Q2 2026 security updates and improvements for both standard AWS and GovCloud regions as well as GCP. These AMIs address the Copy Fail Vulnerability.
• Released an updated startup script in our server-terraform to address the Copy Fail Vulnerability. Please reference the corresponded 4.8.11 release in the server-terraform repository.
• Updated contexts-service security context user configuration to improve service security posture.
• Fixed various pathing issues in component templates which blocked customers from being able to set the replica number for some of our services.

CVE Fixes

• CVE-2026-39882 in OpenTelemetry OTLP HTTP exporter was addressed in docker-provisioner service.
• CVE-2026-39883 in OpenTelemetry SDK was addressed in execution-gateway, machine-provisioner, distributor services.
• CVE-2026-33186 in gRPC was addressed in public-api-service, policy-service, permissions-service, oidc-service, ciam-gateway services.
• CVE-2026-34986 in go-jose was addressed in public-api-service, oidc-service, ciam-gateway, output services.
• CVE-2026-33816 in pgx was addressed in oidc-tasks-service, policy-service, permissions-service, machine-provisioner, distributor services.
• CVE-2025-13465 in lodash was addressed in web-ui-consolidated service.
• CVE-2026-33870 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33871 in Netty was addressed in domain-service, contexts-service services.
• CVE-2026-33814 in golang.org/x/net was addressed in step, execution-gateway services.
• Updated default nginx unprivileged image tag to 1.30.1 to address the following CVEs: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934, CVE-2026-42945, CVE-2026-42946
• Updated RabbitMQ to fix known CVEs in the message broker component. This addresses security vulnerabilities in the messaging infrastructure.

Note

This is the last update for Server 4.7 as it has reached end of life. Please upgrade to Server 4.8.x.

Fixes

• Updated the IMDS client in machine-agent to fallback to IMDSv1 if it can’t communicate with IMDSv2
• Fixed incorrect kong HTTP header
• Fixed a bug where failed pipelines would produce an url that points to circleci.com rather than the CircleCI Server’s domain
• Fix for intermittent “S3 ExpiredToken” errors which occurred during workspace uploads for jobs running longer than 15 minutes

Image Updates

• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• circle-www-api
• cron-service
• cron-service-migrator
• domain-service
• domain-service-migrator
• init-known-hosts
• machine-provisioner
• machine-provisioner-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• policy-service
• runner-admin
• runner-admin-migrator
• server-postgres
• server-rabbitmq
• server-redis
• web-ui
• web-ui-authentication
• web-ui-insights
• web-ui-onboarding
• workflows-conductor
• workflows-conductor-migrator

Updates

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

• postgresql
• mongodb
• redis
• rabbitmq

Image Updates

The following images have moved from Bitnami-hosted to CircleCI-hosted:

• mongodb
• redis

The following images have been updated since 4.8.1:

• webhook-service
• permissions-service
• domain-service
• orb-service
• policy-service
• web-ui-server-admin
• branch-service
• authentication-svc
• workflows-conductor
• builds-service
• cron-service

NOTE

Please note this release has been marked as broken and should not applied. Fixes will be applied in the 4.7.8 patch.

Updates

• Enable Redis permissions cache in server
• Stopped sending duplicate execution-engine-config-str spec to WFC, reducing message size by up to 15 MB for large customer configs

Bug Fixes

• Fixed a bug where “empty pipelines” responses from the API would prevent the UI from loading.
• The authentication process now correctly utilizes a cache for JWT.
• docker-provisioner-provisioner will roll when a manually provided certificate is changed
• Addressed CVEs in authentication-service, api-service and web-ui services

Chart Updates

The following charts have moved from Bitnami-hosted to CircleCI-hosted:

• postgresql
• mongodb
• redis
• rabbitmq

Image Updates

The following images have moved from Bitnami-hosted to CircleCI-hosted:

• mongodb
• redis

The following images have been updated since 4.7.6:

• postgres
• rabbitmq
• web-ui-onboarding
• web-ui-org-settings
• cron-service
• web-ui-insights
• web-ui
• ciam-gateway
• branch-service
• web-ui-authentication
• workflows-conductor
• authentication-svc
• api-service
• runner-admin
• domain-service
• policy-service
• builds-service

CircleCI will be moving to twice-yearly major and minor version releases of Server. Releases will be targeted for Spring (April) and Fall (October). Patch releases for bugs and security updates will be made monthly as needed.

We will support two minor releases or 1 year from the date of the release. This is a change from the current 4 minor releases or 1 year from the date of the release. After the April release of server 4.8, supported versions of server will include server 4.8 and server 4.7.

A catch-up release will be made available in the coming months that will allow existing customers to upgrade from 4.3, 4.5, and 4.6 variations to the most recent server version 4.7. Allowing customers to get to a supported version before we release 4.8 in April.

Server release 4.8 is planned to include some new features. The first enables more flexibility in defining which jobs or workflows run using conditional expressions. The second is the introduction of an observability stack that will enable proactive monitoring of the state of the server installations.