Server Release 4.9.7

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new Kong and datastore images before you upgrade. See Configuration Changes below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.7

Updates

• Updated all CircleCI services to stop trusting certificates from the compromised eMudhra intermediate CAs, so these services reject forged certificates that chain to them. The Go services moved to Go 1.26.10. The Clojure service images were rebuilt to no longer have the compromised root certificates. No dependency changes were required in the clojure or JVM runtimes.

New Features

• Added Kong routes for the OAuth authorization server, its discovery endpoints and the v3 API. You can now run the CircleCI CLI auth login command against a Server install.

Bug Fixes

• Fixed a crash loop on installs that keep tracing disabled (the default). Kubernetes service links injected a non-numeric OTEL_COLLECTOR_PORT value, which some services could not parse. The chart now always sets a numeric port, so these pods start without a workaround.
• Fixed the Insights CronJobs, which ran as the wrong user and failed with “Permission denied”. The hourly and daily Insights refresh jobs now complete.
• Fixed HTTP 500 errors on the project pipelines list when an outbound proxy is enabled. The chart now exempts the in-cluster headless service hostnames from the Java proxy settings, so internal gRPC calls no longer go to the corporate proxy.
• Fixed the “Details” links on approval job statuses in GitHub, which returned 404. The links now open the workflow page again.
• Fixed the web-ui on Server installs sending experiment and onboarding analytics requests to CircleCI cloud and to an endpoint that Server does not deploy. These requests failed silently, so no data reached either service. They only added errors to the browser console. Server installs no longer make these requests.

CVE Fixes

• CVE-2026-33818, CVE-2026-39821, CVE-2026-39822, CVE-2026-42505, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862 in the Go standard library was addressed in init-known-hosts, server-license services.
• CVE-2026-46600, CVE-2026-78659, CVE-2026-78660, CVE-2026-78661, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032, CVE-2026-97045 in golang.org/x/net was addressed in docker-provisioner, execution-gateway, machine-provisioner, no-op-job-provider, output, picard, step services.
• CVE-2026-56855, CVE-2026-78662 in golang.org/x/crypto was addressed in authentication-svc, distributor, machine-provisioner, no-op-job-provider, oidc-tasks-service, output, public-api-service, runner-admin, step services.
• CVE-2026-56864, CVE-2026-56865 in golang.org/x/mod was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, oidc-tasks-service, output, permissions-service, policy-service, runner-admin, step services.
• CVE-2026-46603 in golang.org/x/image was addressed in public-api-service service.
• CVE-2026-84304, CVE-2026-84445 in gRPC-Go (google.golang.org/grpc) was addressed in authentication-svc, ciam-gateway, distributor, execution-gateway, lock-job-provider, no-op-job-provider, oidc-service, permissions-service, policy-service, public-api-service, step services.
• CVE-2026-41178 in OpenTelemetry Go (go.opentelemetry.io/otel) was addressed in distributor, execution-gateway, oidc-service, permissions-service services.
• CVE-2026-81870 in the OpenTelemetry Go OTLP trace exporters (otlptracegrpc, otlptracehttp) was addressed in authentication-svc, ciam-gateway, distributor, lock-job-provider, machine-provisioner, no-op-job-provider, oidc-service, output, permissions-service, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-114437 in go-chi (github.com/go-chi/chi/v5) was addressed in authentication-svc, ciam-gateway services.
• CVE-2026-73500 in the etcd Go client (go.etcd.io/etcd/client/pkg/v3) was addressed in authentication-svc service.
• CVE-2026-100347, CVE-2026-100348, CVE-2026-100349, CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, CVE-2026-100354 in kin-openapi (github.com/getkin/kin-openapi) was addressed in public-api-service service.
• CVE-2026-41579 in runc (github.com/opencontainers/runc) was addressed in docker-provisioner service.
• CVE-2026-5160 in goldmark (github.com/yuin/goldmark) was addressed in docker-provisioner service.
• CVE-2026-10722 in ebpf-go (github.com/cilium/ebpf) was addressed in docker-provisioner service.
• CVE-2026-79921 in the RabbitMQ Go client (github.com/rabbitmq/amqp091-go) was addressed in execution-gateway service.
• CVE-2026-75595, CVE-2026-75596 in Netty (io.netty:netty-handler) was addressed in api-service service.
• CVE-2026-54399 in Apache HttpComponents (httpcore5) was addressed in domain-service service.
• CVE-2026-64641, CVE-2026-64643, CVE-2026-64644, CVE-2026-64645, CVE-2026-64646, CVE-2026-64647, CVE-2026-64648, CVE-2026-64649, CVE-2026-75604, CVE-2026-96889 in Next.js (next) was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-13676, CVE-2026-16221, CVE-2026-18446, CVE-2026-75899, CVE-2026-75975, CVE-2026-76172 in fast-uri was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-59869, CVE-2026-84375 in js-yaml was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-67213, CVE-2026-67214, CVE-2026-73086 in nanoid was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614 in @xmldom/xmldom was addressed in web-ui, web-ui-server-admin services.
• CVE-2026-111755, CVE-2026-111756 in follow-redirects was addressed in web-ui-server-admin service.
• CVE-2026-111943 in the system CA trust store (the emSign ECC Root CA - G3 and AAA Certificate Services roots behind the compromised eMudhra intermediates) was addressed in kong, server-redis services.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in kong, server-rabbitmq services.

Configuration Changes

• Kong now runs a CircleCI-maintained Kong image from the CircleCI registry instead of the upstream kong:3.4.2 image from Docker Hub. We made this change so that we could timely patch the Kong image to address the compromised eMudhra root certificates (CVE-2026-111943) and Node2Shell vulnerability (CVE-2026-111497). CircleCI Hosted Kong image removes libbrotli1, git and libcurl, and it removes both distrusted eMudhra certificate roots. The Kong version stays at 3.4.2. The kong.image.repository and kong.image.tag values are removed. The chart ignores them and builds the Kong image path from global.container.registry and global.container.org, like other CircleCI images.
  • Action: if you mirror images for an air-gapped or private-registry install, mirror the kong image too: cciserver.azurecr.io/kong:3.4.5976-281b064 with the default registry settings. Then remove any kong.image overrides.
• Changed the default rabbitmq.image.tag and redis.image.tag values to rebuilt internal RabbitMQ and Redis images: RabbitMQ from 3.12.4071-a535ab2 to 3.12.5977-281b064, and Redis from 6.2.2471-c0995cc to 6.2.5979-281b064. The new images remove the distrusted eMudhra roots, and the major and minor versions do not change, so no migration is needed.
  • Action: if you override these tags, set rabbitmq.image.tag to 3.12.5977-281b064 and redis.image.tag to 6.2.5979-281b064, or your datastores keep the old images.
• Added the optional contexts_service.javaToolOptions value. When you set it, the chart passes the value to contexts-service as JAVA_TOOL_OPTIONS. You no longer need to patch the Deployment after each upgrade to add JVM flags. The default is empty, so existing installs do not change.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• branch-service
• branch-service-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• cron-service
• cron-service-migrator
• distributor
• distributor-migrator
• docker-provisioner
• domain-service
• domain-service-migrator
• execution-gateway
• init-known-hosts
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• output
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• server-license
• server-postgres
• server-rabbitmq
• server-redis
• step
• web-ui
• web-ui-server-admin
• webhook-service
• webhook-service-migrator
• workflows-conductor
• workflows-conductor-migrator

Service changes

New components

• kong: the CircleCI-built Kong image (circleci/kong:3.4.5976-281b064), new in images.yaml in this release. It replaces the upstream kong:3.4.2 image from Docker Hub. See Configuration Changes Section.

Deprecated components

None.