Added

• Support for configuring JTI claim inclusion in JWT-SVIDs at entry level (#6514)
• Experimental per-caller rate limiting for the agent Workload API and Envoy SDS (#6724)
• TLS support for the Prometheus metrics endpoint using a SPIRE SVID, with an optional SPIFFE ID allowlist (#6812)
• Optional verification of client certificate IPs in the x509pop node attestor (#6911)
• SPIFFE Broker endpoint, API, and documentation (#6915, #7112)
• disable_group_name_selectors option for the Windows workload attestor (#6957)
• log_selectors configuration item for the agent (#6981)
• Support for two additional PQC curves (#6999)
• Tag-based key discovery support in the aws_kms Key Manager plugin (#7006)
• Logger service for spire-agent (#7017)
• Configurable batch size for pruning attested nodes (#7100)

Security

• Migrated github.com/docker/docker dependencies to their github.com/moby/moby equivalents to resolve CVEs (#7078)

Changed

• Deprecation warnings now use dedicated log markers, making them easier to detect in logs (#6908)
• The OIDC Discovery Provider now warns when allow_insecure_scheme is enabled (#6970)
• The post-quantum cryptography policy is now applied to the bundle endpoint and Prometheus server (#6995)
• Attested nodes are now fetched in bulk, reducing database load in large deployments (#7022)
• Agent health check loopback calls no longer emit RPC metrics, reducing metrics noise (#6929)
• Pod and container IDs are now preferably determined from the cgroup file (#7060)
• Optimized the MySQL list entries query to reduce database CPU usage under load (#7113)
• Added AWS CA certificates for new regions to the aws_iid node attestor (#6879)
• Documented URISanSelectors for the agent SPIFFE ID template (#6872)
• Datastore configuration documentation updates (#7023)

Fixed

• azure_imds node attestation for standalone VMs (#6807)
• azure_imds plugin signature validation (#6960)
• The auto-created join-token alias entry is now cascade-deleted when its attested node is deleted, evicted, or pruned (#6946)
• The CA journal now survives transient datastore save failures, preserving CA continuity (#6964)
• The delegated API no longer serves JWT-SVIDs for admin or downstream entries (#6972)
• The event cache now keeps previous first/last event information when reloading (#6994)
• The structured logger is now used for rebootstrap messages, and typos were fixed (#7000)
• The spire upstream authority plugin now validates a missing Workload API endpoint (#7008)
• The gcp_kms plugin no longer intermittently fails to retrieve a newly created public key (#6924)
• Tolerate mountinfo lines with an empty mount source (#7044)
• The agent now treats failure of all attestation plugins as an overall failure and returns Unavailable (#7045)
• Fixed the http_challenge agent name validation regex (#7066)
• Corrected TTL logging in the delegated identity X.509-SVID subscriber (#7071)
• spire-agent now attempts to enable SE_DEBUG_PRIVILEGE at startup on Windows (#7073)
• Data races in the built-in BundlePublisher plugins on dynamic reconfiguration (#7082)

Security

• Fixed an issue in the azure_imds server node attestor plugin where attested document validation anchored the first certificate in the PKCS7 certificate bag to the trusted Azure roots, while the signature was verified against a separate signer certificate resolved from the PKCS7 SignerInfo. An attacker could place a legitimate Azure metadata certificate in the bag alongside content signed by an unrelated certificate and have a forged attested document accepted, impersonating an arbitrary virtual machine during node attestation. Thank you Carlo Teubner for reporting this issue.

Changed

• Updated golang.org/x/net to v0.55.0 and golang.org/x/crypto to v0.52.0.

Security

• Fixed an issue in the azure_imds server node attestor plugin where attested document validation anchored the first certificate in the PKCS7 certificate bag to the trusted Azure roots, while the signature was verified against a separate signer certificate resolved from the PKCS7 SignerInfo. An attacker could place a legitimate Azure metadata certificate in the bag alongside content signed by an unrelated certificate and have a forged attested document accepted, impersonating an arbitrary virtual machine during node attestation. Thank you Carlo Teubner for reporting this issue.

Changed

• Updated the Go toolchain to 1.26.3.
• Updated golang.org/x/net to v0.55.0, golang.org/x/crypto to v0.52.0, and github.com/go-jose/go-jose/v4 to v4.1.4.

Added

• New account_id selector for aws_iid nodeattestor (#6697)
• TLS support for the prometheus metrics sink (#6718)
• Support for specifying that X509-SVIDs for a registration entry should not be prefetched (#6360)
• The docker workload attestor now supports rootless Podman (#6798)
• PROXY protocol support for rate limiting behind load balancers (#6819)
• Support for the agent to fetch the X509-SVID for SPIFFE attestation mode from the Workload API socket (#6884)
• iss claim support for WIT-SVIDs (#6857)
• Instance flag support for spire-server and spire-agent CLI (#6789)
• Experimental, optional spiffe_id node selector to help aliasing individual nodes (#6865)
• HashiCorp Vault Key Manager plugin (#6889)

Changed

• A metric label was renamed from 'bootstraped' to 'bootstrapped' (#6503)
• Updated cosign to the v3 major release (#6493)
• Authorized entry lookup with events based cache should now be as fast as without the events based cache (#6645)
• spire-agent api fetch x509 returns bundles in sorted alphabetic order by trust domain (#6784)
• The k8s_psat node attestor includes the cluster in the attestation failure logs (#6785)
• Azure sdk libraries have been updated to more recent major versions. (#6494)
• The sigstore support in k8s and docker attestors was promoted out of experimental (#6901, #6906)
• The spire-agent WorkloadAPI server now specifies a read buffer size which may improve memory usage with large number of connections (#6875)
• Stop wrapping objects in slices when printing (#6655)

  🚨 This is a potentially breaking change if you make use of the JSON output of the CLI 🚨

• Documented image selector limitations for k8s workload attestor (#6930)
• gcp_iit node attestor will now use service account email from identity token so it no longer depends on use_instance_metadata being true (#6869)
• Upgraded Go to 1.26.3 (#6947)
• Various testing, linter errors and improvements (#6891, #6836, #6864, #6788, #6847, #6809, #6830, #6831, #6746, #6777, #6745, #6776, #6782, #6744, #6734, #6756, #6752, #6740, #6738)

Fixed

• Potential nil panic in the spire upstream authority plugin (#6773)
• Nil panic in the azure_imds plugin for instances without a Network Security Group attached (#6795)
• azure_key_vault key manager plugin now supports Azure Managed HSM (#6751)
• Connections to the agent Debug service would lead to "unrecognized service" errors in logs (#6878)
• An issue in the aws_kms plugin which would revert rotated aliases (#6805)

Security

• Fixed an issue in the aws_iid server node attestor plugin where the RSA-2048 PKCS7 attestation path verified the PKCS7 signature against its embedded content but returned the identity document parsed from a separate, attacker-controlled field of the attestation data. An attacker who controlled any EC2 instance could impersonate any other EC2 instance during node attestation, with all downstream attestation decisions operating on the forged identity. Thank you Tianshuo Han for reporting this issue.
• Fixed a TOCTOU issue in the join token data store path where concurrent attestations using the same token could each succeed because tx.Delete() did not report when no row was deleted. The fix uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. Thank you Tianshuo Han for reporting this issue.

Security

• Fixed an issue in the aws_iid server node attestor plugin where the RSA-2048 PKCS7 attestation path verified the PKCS7 signature against its embedded content but returned the identity document parsed from a separate, attacker-controlled field of the attestation data. An attacker who controlled any EC2 instance could impersonate any other EC2 instance during node attestation, with all downstream attestation decisions operating on the forged identity. Thank you Tianshuo Han for reporting this issue.
• Fixed a TOCTOU issue in the join token data store path where concurrent attestations using the same token could each succeed because tx.Delete() did not report when no row was deleted. The fix uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. Thank you Tianshuo Han for reporting this issue.

Security

• Upgrade Go to 1.26.2 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32281

Security

• Upgrade Go to 1.25.9 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32281

Added

• spire-agent version is now reported to spire-server via the PostStatus API and visible in GetAgent/ListAgents CLI output (#6542)

Changed

• The RequirePQKEM TLS policy now uses the standardized X25519MLKEM768 instead of the draft x25519Kyber768Draft00 (#6703)
• OPA policy evaluation performance improved by ~2x, based on benchmarking, through use of partial evaluation (#6633)

Fixed

• ReadOnlyEntry.Clone() was incorrectly copying the Admin boolean into the Downstream field when applying an output mask, causing clients of GetAuthorizedEntries and SyncAuthorizedEntries to receive corrupted authorization metadata. The Admin and Downstream booleana were not used in spire-agent so there was no impact from this (#6636)
• The periodic node cache rebuild was only executing once instead of running continuously at the configured interval (#6661)
• Race condition in the spire upstream authority plugin during shutdown that could cause a nil pointer dereference on the bundle client (#6590)
• aws_iid attestor AWS request timeout increased from 5s to 20s to prevent intermittent attestation failures in large AWS Organizations (#6558)
• Federated trust bundles are now fetched concurrently, reducing the chance of exceeding the agent sync timeout when there are many federation relationships (#6491)
• JWT-SVID refresh now uses a 1s timeout when a cached SVID already exists, preventing an unresponsive server from blocking delivery of a valid cached SVID (#6454)
• Documentation improvements (#6607, #6608, #6632)

Security

• Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information (#6732)
• Fixed an issue where TLS session ticket resumption on the server TCP endpoint could bypass SPIFFE certificate chain validation against the current trust bundle. TLS session tickets are now disabled on the server side, ensuring VerifyPeerCertificate runs on every connection (#6715)