Server Release 4.10.3

Before Upgrading

See the CircleCI server 4.10 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new NGINX image before you upgrade. See Configuration Changes below.

If you create your Nomad clients with the nomad-aws or nomad-gcp modules from server-terraform, the 4.10.3 module defaults move your Nomad clients to Ubuntu 24.04 when you update the module version. See details below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.10.3

Updates

The default Linux VM images for Machine Provisioner and remote Docker jobs were updated in all regions for AWS (including GovCloud) and GCP. If you set machine_provisioner.providers.ec2.linuxAMI or machine_provisioner.providers.gcp.linuxImage, your own image stays in use for x86 Linux jobs.

Nomad client images now based on Ubuntu 24.04

We are publishing new images for AWS and GCP customers to address CVE-2026-98432 and CVE-2026-99999 in the Linux kernel.

Important: The new Nomad client images are now based on Ubuntu 24.04 instead of Ubuntu 22.04.

For AWS

The nomad-aws module in server-terraform now uses the CircleCI Server Nomad AMI for Ubuntu 24.04 by default. The default of machine_image_names changes from ["CircleCIServerNomad*"] (Ubuntu 22.04) to ["ServerNomadV2-*"]. The new AMI has Linux kernel 6.8.0-1069 with the fixes for CVEs mentioned above.

The default applies to the Docker Nomad clients. It also applies to the Nomad servers when you set deploy_nomad_server_instances to true. Podman clients (use_podman set to true) do not change: they still use machine_image_names_podman. The client startup script now installs the Docker package that matches the Ubuntu release, so it works on 22.04 and 24.04 AMIs.

For GCP

The nomad-gcp module in server-terraform now boots Nomad clients from the CircleCI Server Nomad client image for GCP by default. The default of machine_image_project changes from ubuntu-os-cloud to circleci-images. The default of machine_image_family changes from ubuntu-2204-lts to circleci-server-nomad-image-2404, which stores the image in the us multi-region.

The image has Ubuntu 24.04, Linux kernel linux-gcp 6.8.0-1073. Two regional families have the same image: circleci-server-nomad-image-2404-us-central1 and circleci-server-nomad-image-2404-us-east1.

The client startup script now supports images that already boot with cgroup v1 enabled (required for Docker), and it installs the Docker package that matches the Ubuntu release.

Action: if your organization uses the GCP compute.trustedImageProjects policy, allow projects/circleci-images.

Bug Fixes

• Fixed Docker layer caching (DLC) on machine images that use the containerd image store, such as images with Docker 29. A restored cache marked build steps as CACHED while their image layers were missing, and the job failed with “failed to get reader from content store”. DLC now supports the containerd image store, so restored caches work again.
• Fixed the job Artifacts tab, which hid the artifacts of jobs older than 30 days even when object_storage.expireAfter was 0 (the default) or another value. The tab showed the message that artifacts expire after 30 days, although the artifacts were still in object storage. The tab now uses object_storage.expireAfter again: with 0 it does not hide artifacts, and with another value it hides them after that number of days.
• Fixed the pipeline values of builds that the v1 and v1.1 APIs trigger with a config override. These builds had pipeline.config_source set to vcs and also had the config repository values. Their OIDC tokens then said that the config came from the repository. Now pipeline.config_source is api and the config repository values are not set, so the OIDC config claims are correct. If your OIDC trust policies use the config claims for these builds, review them.

CVE Fixes

• CVE-2026-116587 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in authentication-svc, ciam-gateway, contexts-service, docker-provisioner, execution-gateway, lock-job-provider, no-op-job-provider, notifications, oidc-service, oidc-tasks-service, output, permissions-service, picard, policy-service, public-api-service, step services.
• CVE-2026-116585, CVE-2026-116586 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in contexts-service service.
• CVE-2026-78661, CVE-2026-97045 in golang.org/x/net was addressed in api-gateway, authentication-svc, ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, oidc-tasks-service, output, permissions-service, picard, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-116591 in compress (github.com/klauspost/compress) was addressed in authentication-svc, ciam-gateway, contexts-service, distributor, docker-provisioner, execution-gateway, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, step services.
• CVE-2026-68497, CVE-2026-89407, CVE-2026-89425, CVE-2026-91776, CVE-2026-91777 in Jackson (jackson-core and jackson-databind) was addressed in builds-service service.
• CVE-2026-19204 in Jetty WebSocket (jetty-websocket-core-common) was addressed in builds-service, orb-service, workflows-conductor services.
• CVE-2023-54404 in Zod (zod) was addressed in web-ui service.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in server-nginx service and in the nomad-gcp Nomad client image.
• CVE-2026-98432, CVE-2026-99999 in the Linux kernel was addressed in the nomad-aws and nomad-gcp Nomad client images.

Configuration Changes

NGINX now runs a CircleCI-maintained NGINX image from the CircleCI registry instead of the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. We made this change so that we can patch the NGINX image quickly, for example, for the Node2Shell vulnerability (CVE-2026-111497) in libbrotli1.

The new image is built on nginx/nginx-unprivileged 1.31.8, so NGINX moves from 1.30.1 to 1.31.8.

The nginx.image.repository and nginx.image.tag values are removed. The chart ignores them and builds the NGINX image path from global.container.registry and global.container.org, like other CircleCI images.

Action: If you mirror images for an air-gapped or private-registry install, mirror the server-nginx image too: cciserver.azurecr.io/server-nginx:1.31.6046-c0318cf with the default registry settings. Then remove any nginx.image overrides.

Service changes

New components

server-nginx: the CircleCI-built NGINX image (circleci/server-nginx:1.31.6046-c0318cf), new in images.yaml in this release. It replaces the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. NGINX already ran before, so the change is described under Configuration Changes above.

Component Updates

• api-gateway
• approval-job-provider-migrator
• authentication-svc
• authentication-svc-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• notifications
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• workflows-conductor
• workflows-conductor-migrator

Deprecated components

None.