---
layout: docs
page_title: v0.17.0 release notes
description: >-
  Learn more about the new features included in the Boundary 0.17.0 release. Understand any deprecations, changes, and known issues.
---

# Boundary 0.17.0 release notes

**GA date:** July 31, 2024

@include 'release-notes/intro.mdx'

## Important changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Change</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Role creation
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary. The image now includes <code>wget</code>, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>.
    <br /><br />
    Learn more:&nbsp; <a href="#known-issues-and-breaking-changes">Known issues and breaking changes </a>
    </td>
  </tr>
  </tbody>
</table>

## New features

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Feature</th>
      <th style={{verticalAlign: 'middle'}}>Update</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Centralized tag management for workers
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Prior to this version, if you wanted to edit or update worker tags, you had to do it using the worker configuration file, the CLI, or the API. Now, you can edit worker tags directly in the Boundary UI.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/workers/worker-tags">Worker tags</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Multi-scope roles and inheritance
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
      You can now assign a single role to multiple scopes, making it easier to grant permissions to users who must access resources across multiple scopes. You can also configure children scopes to inherit roles.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/configuration/identity-access-management">Permissions in Boundary</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Improved worker failure handling
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
      When you attempt to connect to a target, Boundary randomly selects a worker that has the matching tags to proxy the connection. Before release 0.17.0, unhealthy workers that had issues related to the external storage provider were eligible to proxy connections. The connections would fail, and users had to restart the connection until Boundary selected a healthy worker. <br /><br />
      In this release, Boundary removes workers from the pool of available workers if they have issues with the external storage provider for improved worker failure handling.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/configuration/session-recording/configure-worker-storage">Configure workers for session recording</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      S3-compliant storage options for session recording
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
      As of Boundary 0.16.0, the MinIO plugin made it possible to use MinIO storage as a storage option for session recording. Starting in this release, you can use the MinIO plugin to configure storage using other S3-compliant storage providers.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/configuration/session-recording/storage-providers/configure-s3-compliant">Configure S3-compliant storage for session recording</a>.
    </td>
  </tr>


  </tbody>
</table>

## Known issues and breaking changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Version</th>
      <th style={{verticalAlign: 'middle'}}>Issue</th>
      <th style={{verticalAligh: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Rotation of AWS access and secret keys during a session results in stale recordings
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials.
    <br /><br />
    As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials.
    Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back.
    </td>
  </tr>
  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Unsupported recovery workflow during worker failure
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example.
    <br /><br />
    Learn more:&nbsp;
    <a href="/boundary/docs/troubleshoot/troubleshoot-recorded-sessions#unsupported-recovery-workflow">Unsupported recovery workflow</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.1+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary.
    <br /><br />
    The image now includes <code>wget</code>. You can use <code>wget</code> to check the health endpoint for workers.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/operations/health#check-the-health-endpoint-using-wget">Check the health endpoint using <code>wget</code></a>
    <br /><br />
    If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>. Refer to the following commands for examples of using <code>apk</code> to install <code>curl</code>:
    <br /><br />
    <code>&lt;CONTAINER-ID&gt; apk add curl</code>
    <br /><br />
    or
    <br /><br />
    <code>kubectl exec -ti &lt;NAME&gt; -- apk add curl</code>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0
    <br /><br />
    (Fixed in 0.17.1)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Using an invalid alias results in a 401 message
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If you tried to connect to an invalid alias, Boundary returned a message with the 401 status code. The 401 status code could cause users to believe that they did not properly authenticate, rather than realizing the alias resource was invalid.
    <br /><br />
    This issue is fixed in Boundary version 0.17.1. If you use an invalid alias, Boundary now properly returns a 404 status code, indicating that it could not find the alias resource.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/concepts/aliases">Aliases</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0
    <br /><br />
    (Fixed in 0.17.1)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Session recording fails when you use Secure File Copy (SCP)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If you tried to use SCP during a recorded session, the session recording details may shown the recording state as Failed, and you may not have been able to play back the session.
    <br /><br />
    This issue occurs when a recorded session file is too large. It can happen when you use SCP to transfer large files during a recorded session, In Boundary version 0.17.1, we have increased the maximum size for recorded session files to 5 GB. This issue should happen less often now, but be careful when you use SCP during a recorded session, because it can result in large recorded session files.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/configuration/session-recording#storage-considerations">Session recording storage considerations</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.8.0 - 0.17.2
    <br /><br />
    (Fixed in Boundary Community Edition and Boundary Enterprise 0.17.3)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary controller incorrectly handles HTTP requests and stops prematurely (HCSEC-2024-28)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary Community Edition and Boundary Enterprise incorrectly handle HTTP requests while the Boundary controller is starting up, which may cause the controller to stop prematurely. Boundary is only vulnerable to this flaw during the controller's initialization, which usually occurs in milliseconds during Boundary's startup process.
    <br /><br />
    This vulnerability, HCSEC-2024-28, is fixed in Boundary Community Edition and Boundary Enterprise versions 0.16.4, 0.17.3, and 0.18.2.
    <br /><br />
    Learn more: <a href="https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service">HCSEC-2024-28: Boundary controller incorrectly handles http requests on initialization which may lead to a denial of service</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.16.0 - 0.17.3
    <br /><br />
    (Fixed in Boundary Enterprise 0.17.4)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Performance is impacted by query
    </td>
    <td style={{verticalAlign: 'middle'}}>
    A query that was added with the aliases feature performed a full table scan of the target table. The scan could negatively impact performance.
    <br /><br />
    The scan was replaced with a more efficient method for scanning targets. This issue has been resolved.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.16.0 - 0.17.3
    <br /><br />
    (Fixed in Boundary Enterprise 0.17.4)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Performance is impacted by database transactions
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Database transactions were not using the correct reader and writer functions or context. This issue could cause delays and negatively impact system performance.
    <br /><br />
    A number of minor fixes were added to improve the way Boundary performs database transactions. This issue has been resolved.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0 - 0.17.3
    <br /><br />
    (Fixed in Boundary Enterprise 0.17.4)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    GO-2024-3333
    <br /><br />
    CVE-2024-45338
    <br /><br />
    CVE-2024-45337
    </td>
    <td style={{verticalAlign: 'middle'}}>
    The Go dependencies that were used in Boundary release 0.17.x contained security vulnerabilities. Boundary Enterprise 0.17.4 was updated to use new versions of the dependencies. This issue is resolved.
    <br /><br />
    Learn more:
    <br /><br />
    GO-2024-3333: <a href="https://pkg.go.dev/vuln/GO-2024-3333">An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.</a>
    <br /><br />
    CVE-2024-45338: <a href="https://www.cve.org/CVERecord?id=CVE-2024-45338">Non-linear parsing of case-insensitive content in golang.org/x/net/html</a>
    <br /><br />
    CVE-2024-45337: <a href="https://www.cve.org/CVERecord?id=CVE-2024-45337">Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

   <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0 - 0.17.4
    <br /><br />
    (Fixed in Boundary Enterprise and HCP Boundary 0.17.5)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Canceled SSH connections cause performance issues
    </td>
    <td style={{verticalAlign: 'middle'}}>
    When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks.
    <br/><br />
    This issue is resolved in Boundary Enterprise and HCP Boundary version 0.17.5. Workers no longer end up in a busy loop when SSH connections are canceled.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>


  </tbody>
</table>