Server Release 4.10.2

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.2

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

New Features

• Added Kong routes for the OAuth authorization server, its discovery endpoints and the v3 API. You can now run the CircleCI CLI auth login command against a Server install.

Bug Fixes

• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed orb import for site administrators, which failed with an authorization error. A failed downstream lookup during a permission check no longer stops the whole check.
• Fixed context permission checks on Server. Users can edit context environment variables and run jobs that use a context without an organization check that does not apply to Server.
• Fixed the project settings overview page, which showed a Not Found error. The page no longer calls an extra organizations endpoint to decide if the user is an admin.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to an endpoint that Server does not deploy, or to CircleCI cloud on an install without a configured hostname. These requests failed silently, so no data reached either service and no data was ever shared with CircleCI. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56857, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032, CVE-2026-111943 in the Go standard library was addressed in init-known-hosts, oidc-service, permissions-service, runner-admin, server-license services.
• CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032 in golang.org/x/net was addressed in api-gateway, execution-gateway, machine-provisioner, oidc-tasks-service, output, step services.
• CVE-2026-46595, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, ciam-gateway, init-known-hosts, notifications, oidc-service, oidc-tasks-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, execution-gateway, machine-provisioner, oidc-service, output, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in authentication-svc, distributor, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, machine-provisioner, notifications, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2025-30153, CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595 in Netty (io.netty:netty-handler) was addressed in builds-service, circle-www-api, insights-service services.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-67213 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-84375 in js-yaml was addressed in web-ui service.
• CVE-2026-73088, CVE-2026-73089 in browserslist was addressed in web-ui service.
• CVE-2026-69153 in postcss was addressed in web-ui service.
• CVE-2026-71437 in mermaid was addressed in web-ui service.
• CVE-2026-63670, CVE-2026-84371 in sanitize-html was addressed in web-ui service.
• CVE-2026-8769 in @ai-sdk/provider-utils was addressed in web-ui service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-mongodb, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5968-e68a9d5 with the default registry settings. Then remove any kong.image overrides.
• Changed the default mongodb.image.tag, rabbitmq.image.tag and redis.image.tag values to rebuilt internal MongoDB, RabbitMQ and Redis images: MongoDB from 7.0.15-debian-12-r2 to 7.0.5967-e68a9d5, RabbitMQ from 3.12.4066-fcf0542 to 3.12.5969-e68a9d5, and Redis from 6.2.2471-c0995cc to 6.2.5966-e68a9d5. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set mongodb.image.tag to 7.0.5967-e68a9d5, rabbitmq.image.tag to 3.12.5969-e68a9d5 and redis.image.tag to 6.2.5966-e68a9d5, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• notifications
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-mongodb
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5968-e68a9d5), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See Configuration Changes Section.

Deprecated components

None.