Maintenance release: dependency and toolchain currency, plus a security fix
to how the platform determines a caller's IP address.
SECURITY
- Client IP addresses could be forged. A request could set an HTTP header that CoreLink then treated as the caller's real IP. This affected audit records, per-IP rate limiting, and the source-IP binding on machine-identity (NHI) sessions. Audit events also recorded a blank IP whenever a proxy header was present. Both are fixed: CoreLink now derives the client IP only from hops it can verify, and the reverse proxy strips the headers an attacker could supply.
- Action required: machine identities with an active session will be asked to reconnect once after upgrading, because the source IP recorded against their existing session no longer matches.
- Resolved 20 known vulnerabilities reachable from CoreLink code, including a SQL-injection issue in the PostgreSQL driver, two HTML-escaping bypasses in the Go standard library, and five denial-of-service issues in the SSH library used by session brokering.
CHANGED
- Built on Go 1.26.5, with refreshed AWS, Azure and Google Cloud SDKs and updated LDAP, MySQL, SQL Server and WebAuthn clients. Relevant if your security review tracks the runtime and libraries CoreLink ships.
FIXED
- Declarative connectors now load on single-host installs. The connector manifests were missing from the droplet package, so Jira, Slack, Splunk, PagerDuty, Okta and CrowdStrike connectors silently did not register.
Initial public release of CoreLink — a unified identity security platform
for secrets management, privileged access, session brokering, and
compliance.
ADDED
- User Behavior Analytics. A new Behavioral Analytics dashboard surfaces anomalous access patterns, peer-group outliers, and baselines for high-risk users — so security teams can spot drift and investigate unusual activity without leaving CoreLink.
- Data residency controls. Pin tenant data to a specific region and get alerted the moment a violation occurs. Configure your residency policy from Tenant Settings → Data Residency.
- Device posture enforcement. Require endpoint compliance and EDR posture checks before granting access to secrets or privileged sessions. Policies are per-tenant and auditable.
- Event Bus subscriptions. Route platform events (secret access, session start/end, policy decisions, approvals) to external systems via webhooks. Each subscription has its own delivery history and retry policy.
- Agent-to-Agent registry. Register machine identities — service accounts, CI workers, internal tools — and issue scoped access tokens. See what each agent did, when, and from where.
- OAuth2 and OIDC application management. Register first-party OAuth2 clients for delegated authorization flows from the IAM section.
- Identity Provider configuration. Configure SSO with OIDC or LDAP from a single page. Email-domain routing supported for enterprise deployments.
- Cloud credential vending. Request scoped, time-limited credentials for AWS, Azure, and GCP from the self-service catalog.
- Knowledge transfer workflows. Support teams can capture KT sessions, track custom fields per ticket, and use canned responses.
- Self-hosted deployment option. Deploy CoreLink to your own infrastructure alongside the existing managed service.
- Release notes page. Browse what's new at any time from Changelog in the site footer or What's New in the avatar menu.
FIXED
- MFA enrollment no longer loops. If your organization required MFA and you enrolled via email or SMS one-time passcode, you previously stayed redirected to the MFA setup page forever. Email OTP, SMS OTP, authenticator apps, and security keys now all correctly satisfy the MFA requirement.
- Billing page title rendered encoded punctuation instead of the intended text. Fixed.
- Two-Factor Authentication page showed an empty screen when your tenant had not enabled any MFA methods. It now explains what you are seeing and links to the setting where methods are enabled.
- Application management page was misaligned on wide monitors. Content is now properly centered.
- Knox assistant rendered an inline "read aloud" button on every message that only appeared on hover. Removed — text-to-speech is available from voice-call mode instead.
CHANGED
- Consistent page headers across the app. Every page now uses the same title, subtitle, and action-button layout, so navigating between sections feels predictable.
- Cleaner navigation. Redundant breadcrumbs above page titles were removed — the left sidebar shows where you are, and titles speak for themselves.
- Refined detail views. Badge placement, status pills, and action buttons on resource detail pages are more visually consistent.