---
layout: docs
page_title: v0.18.0 release notes
description: >-
  Learn more about the new features included in the Boundary 0.18.0 release. Understand any deprecations, changes, and known issues.
---

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
> [!IMPORTANT]  
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️

# Boundary 0.18.0 release notes

**GA date:** October 15, 2024

@include 'release-notes/intro.mdx'

## Important changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Change</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Role creation
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In a future version Boundary will no longer automatically create roles when new scopes are created. This was implemented prior to multi-scope grants to ensure administrators and users had default permissions in new scopes. Since Boundary 0.15, initial roles created for new clusters provide these permissions by default to all scopes using multi-scope grants.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary. The image now includes <code>wget</code>, which you can alternatively use to check the health endpoint for a worker. If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>.
    <br /><br />
    Learn more:&nbsp; <a href="#known-issues-and-breaking-changes">Known issues and breaking changes </a>
    </td>
  </tr>

<tr>
    <td style={{verticalAlign: 'middle'}}>
    Go version 1.23 TLS handshake behavior changes
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior.
    <br /><br />
    Learn more:&nbsp; <a href="#known-issues-and-breaking-changes">Known issues and breaking changes </a>
    </td>
  </tr>

  </tbody>
</table>

## New features

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Feature</th>
      <th style={{verticalAlign: 'middle'}}>Update</th>
      <th style={{verticalAlign: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Transparent sessions
    </td>
    <td style={{verticalAlign: 'middle'}}>
      BETA
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Transparent sessions allows users to eliminate steps in their current workflows using Boundary’s Client Agent, a component that operates in the background to intercept network traffic and automatically route this traffic through a session if the user is authenticated and authorized.
    <br /><br />
    Platform teams and access management teams that administer Boundary can now build much faster, simpler secure remote access workflows that feel more intuitive and invisible to their developer customers.
    <br /><br />
    Learn more:&nbsp;<a href="/boundary/docs/concepts/transparent-sessions">Transparent sessions</a> and <a href="/boundary/docs/api-clients/client-agent">Client Agent</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      Backblaze B2 support for storage buckets
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
      Backblaze B2 is now supported as a storage provider for session recording storage buckets.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/configuration/session-recording/storage-providers/configure-s3-compliant">Configure an S3-compliant storage provider</a>.
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
      AssumeRole support for AWS dynamic host catalogs
    </td>
    <td style={{verticalAlign: 'middle'}}>
      GA
    </td>
    <td style={{verticalAlign: 'middle'}}>
      AWS host plugins now support AssumeRole. AssumeRole returns a set of temporary security credentials that you can use to access AWS resources.
      <br /><br />
      Learn more:&nbsp;<a href="/boundary/docs/hosts/aws">AWS dynamic host catalogs</a>.
    </td>
  </tr>

  </tbody>
</table>

## Known issues and breaking changes

<table>
  <thead>
    <tr>
      <th style={{verticalAlign: 'middle'}}>Version</th>
      <th style={{verticalAlign: 'middle'}}>Issue</th>
      <th style={{verticalAligh: 'middle'}}>Description</th>
    </tr>
  </thead>
  <tbody>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Rotation of AWS access and secret keys during a session results in stale recordings
    </td>
    <td style={{verticalAlign: 'middle'}}>
    In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials.
    <br /><br />
    As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials.
    Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back.
    </td>
  </tr>
  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.13.0+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Unsupported recovery workflow during worker failure
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example.
    <br /><br />
    Learn more:&nbsp;
    <a href="/boundary/docs/troubleshoot/troubleshoot-recorded-sessions#unsupported-recovery-workflow">Unsupported recovery workflow</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.1+
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Docker image no longer contains <code>curl</code>
    </td>
    <td style={{verticalAlign: 'middle'}}>
    As of version 0.17.1 and later, the <code>curl</code> binary is no longer included in the published Docker container image for Boundary.
    <br /><br />
    The image now includes <code>wget</code>. You can use <code>wget</code> to check the health endpoint for workers.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/operations/health#check-the-health-endpoint-using-wget">Check the health endpoint using <code>wget</code></a>
    <br /><br />
    If your workflow depends on having <code>curl</code> in the image, you can dynamically install it using <code>apk</code>. Refer to the following commands for examples of using <code>apk</code> to install <code>curl</code>:
    <br /><br />
    <code>&lt;CONTAINER-ID&gt; apk add curl</code>
    <br /><br />
    or
    <br /><br />
    <code>kubectl exec -ti &lt;NAME&gt; -- apk add curl</code>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.18.0
    <br /><br />
    (Fixed in 0.18.1)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Users are incorrectly removed from managed groups
    </td>
    <td style={{verticalAlign: 'middle'}}>
    If your organization has over 10,000 managed groups, Boundary may incorrectly remove users from the managed group memberships.
    <br /><br />
    In version 0.18.0 and earlier, there was a maximum number of managed groups supported for an auth method. If you had over 10,000 managed groups, Boundary may have incorrectly removed a user from a group during authentication. This issue is fixed in version 0.18.1. There is no longer a maximum number of managed groups.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/domain-model/managed-groups">Managed groups</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.18.0
    <br /><br />
    (Fixed in 0.18.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Session recordings fail with an error
    </td>
    <td style={{verticalAlign: 'middle'}}>
    When large numbers of sessions were created around the same time using the AssumeRole API, the AWS STS (Security Token Service) credentials sometimes failed to refresh and session recordings would fail. The failure occurred due to throttling from AWS.
    <br /><br />
    Version 0.18.2 adds a cache for Amazon S3 clients to store temporary credentials and prevent AWS resources from being overwhelmed. This issue is now resolved.
    <br /><br />
    Learn more:&nbsp; <a href="/boundary/docs/configuration/session-recording/storage-providers/configure-s3">Configure Amazon S3 as a storage provider</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.8.0 - 0.18.1
    <br /><br />
    (Fixed in Boundary Community Edition and Boundary Enterprise 0.18.2)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary controller incorrectly handles HTTP requests and stops prematurely (HCSEC-2024-28)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary Community Edition and Boundary Enterprise incorrectly handle HTTP requests while the Boundary controller is starting up, which may cause the controller to stop prematurely. Boundary is only vulnerable to this flaw during the controller's initialization, which usually occurs in milliseconds during Boundary's startup process.
    <br /><br />
    This vulnerability, HCSEC-2024-28, is fixed in Boundary Community Edition and Boundary Enterprise versions 0.16.4, 0.17.3, and 0.18.2.
    <br /><br />
    Learn more: <a href="https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service">HCSEC-2024-28: Boundary controller incorrectly handles http requests on initialization which may lead to a denial of service</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.18.x
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x CLI is unable to establish connections using the <code>boundary connect</code> command
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Boundary version 0.18.x uses Go version 1.23, which introduced a new TLS handshake behavior. Some VPN providers struggle with the TLS handshake being sent over 2 frames instead of 1, which can lead to Boundary version 0.18.x controllers, workers, or clients being unable to establish connections. As a workaround, you can revert back to the previous TLS handshake behavior.
    <br /><br />
    To revert back to the previous TLS handshake behavior, add the <code>tlskyber=0</code> parameters to the GODEBUG environment variable before the <code>boundary connect</code> command. For example:
    <br /><br />
    <code>GODEBUG=tlskyber=0 boundary connect ssh -target-id &lt;ID&gt;</code>
    <br /><br />
    Learn more: <a href="https://github.com/golang/go/issues/70047">Go issue #70047</a> and <a href="https://tip.golang.org/doc/go1.23">Go 1.23 Release Notes</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.16.0 - 0.18.2
    <br /><br />
    (Fixed in Boundary Enterprise 0.18.3)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Performance is impacted by query
    </td>
    <td style={{verticalAlign: 'middle'}}>
    A query that was added with the aliases feature performed a full table scan of the target table. The scan could negatively impact performance.
    <br /><br />
    The scan was replaced with a more efficient method for scanning targets. This issue has been resolved.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.16.0 - 0.18.2
    <br /><br />
    (Fixed in Boundary Enterprise 0.18.3)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Performance is impacted by database transactions
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Database transactions were not using the correct reader and writer functions or context. This issue could cause delays and negatively impact system performance.
    <br /><br />
    A number of minor fixes were added to improve the way Boundary performs database transactions. This issue has been resolved.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0 - 0.18.2
    <br /><br />
    (Fixed in Boundary Enterprise 0.18.3)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    GO-2024-3333
    <br /><br />
    CVE-2024-45338
    <br /><br />
    CVE-2024-45337
    </td>
    <td style={{verticalAlign: 'middle'}}>
    The Go dependencies that were used in Boundary release 0.18.x contained security vulnerabilities. Boundary Enterprise 0.18.3 was updated to use new versions of the dependencies. This issue is resolved.
    <br /><br />
    Learn more:
    <br /><br />
    GO-2024-3333: <a href="https://pkg.go.dev/vuln/GO-2024-3333">An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.</a>
    <br /><br />
    CVE-2024-45338: <a href="https://www.cve.org/CVERecord?id=CVE-2024-45338">Non-linear parsing of case-insensitive content in golang.org/x/net/html</a>
    <br /><br />
    CVE-2024-45337: <a href="https://www.cve.org/CVERecord?id=CVE-2024-45337">Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto</a>
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    <br /><br />
    </td>
  </tr>

  <tr>
    <td style={{verticalAlign: 'middle'}}>
    0.17.0 - 0.18.3
    <br /><br />
    (Fixed in Boundary Enterprise and HCP Boundary 0.18.4)
    </td>
    <td style={{verticalAlign: 'middle'}}>
    Canceled SSH connections cause performance issues
    </td>
    <td style={{verticalAlign: 'middle'}}>
    When an SSH connection was canceled, it could cause a spike in CPU usage. In some cases, egress workers become unresponsive, leading to performance issues. The issue occurred when the connection context was canceled at specific times in the process, creating a busy loop that prevented workers from completing tasks.
    <br/><br />
    This issue is resolved in Boundary Enterprise and HCP Boundary version 0.18.4. Workers no longer end up in a busy loop when SSH connections are canceled.
    <br /><br />
    <a href="/boundary/tutorials/self-managed-deployment/upgrade-version">Upgrade to the latest version of Boundary</a>
    </td>
  </tr>

  </tbody>
</table>