Fixed issues

Last published : Nov 10, 2026
Related information
Release notes

Citrix SecurSpaces™ 2026.9 includes the following fixed issues

2026.9.6 – October 30, 2026

Security

  • Resolved an issue where platform and container tooling used dependencies affected by known vulnerabilities. Go, Git LFS build tooling, Docker CLI, containerd, BuildKit, and MongoDB tool dependencies are updated.
  • Resolved an issue where repository connections could select credentials for the wrong configured provider. Azure DevOps HTTPS requests now select only Azure DevOps applications for the matching organization.

General

  • Resolved an issue where a connected Azure DevOps provider using Microsoft Entra ID still appeared to require authentication and could prevent users from continuing.
  • Resolved an issue where the Azure DevOps import dialog showed a generic repository title for Microsoft Entra ID connections. It now shows Connect To Azure DevOps.
  • Resolved an issue where HTTPS cloning and automatic cloning with Azure DevOps Entra connections failed to use the correct repository credentials.
  • Resolved an issue where SSH repository access could fail when multiple applications shared a Git host. The connection now selects an application with an available key.
  • Resolved an issue where selected Citrix DaaS™ resources could show missing icons after the session expired. The console now clears stale resources and notifies users when they need to sign in again.
  • Resolved an issue where workspace apps lost the original host and protocol supplied by the ingress. Forwarding headers now reach the app through both proxy hops.
  • Resolved an issue where NetScaler® Gateway API deployments could reject console API routing rules. The chart now splits the routes into smaller rules.
  • Resolved an issue where Azure Marketplace sizing guidance overstated workspace capacity. It now accounts for full workspace CPU reservations and identifies unsupported Arm64 node sizes.
  • Resolved an issue where Azure Marketplace deployment required a redundant NetScaler CPX™ license confirmation. The separate check box and ARM parameter acceptIngressLicenseTerms are removed.
  • Resolved an issue where the workspace browser IDE still used the previous bundle after an image update.

2026.9.5 – October 23, 2026

New features

  • Added JSON audit export and optional standard-output collection for SIEM integrations, while retaining CEF file output by default.
  • Added TLS certificate monitoring, validation, and replacement for Community Edition administrators, with expiry notifications and audit records.
  • Added project, owner, and organization ID labels to workspace StatefulSets and pods for cluster filtering and reporting.
  • Added configurable CPU and memory resources for the database migration job and node initialization DaemonSet, plus a Helm check for missing third-party resource settings on clusters with enforcing Kyverno policies.

Security

  • Updated Go, Docker, BuildKit, MongoDB image tools, workspace sidecar and IDE images, and application dependencies to address known vulnerabilities.
  • Resolved an issue where users could access other users' saved Citrix DaaS resource configurations. These requests now apply only to the signed-in user's configuration.
  • Resolved an issue where users could read or change another user's personal schedule, dismiss their setup shortcuts, or accept agreements on their behalf. These actions now require the user's own session.
  • Resolved an issue where user-directory requests exposed project members or privileged-user lists without the required access. Directory results now respect member permissions and platform roles.
  • Resolved an issue where sign-in responses could reveal whether an email address had a local account. Unknown addresses now receive the same routing response as local accounts without single sign-on.
  • Resolved an issue where workspace pages could influence the destination retained for sign-in. The destination is now stored separately from workspace pages and checked against allowed platform addresses.

General

  • Resolved an issue where single sign-on with a changed email address could create a second account instead of opening the existing account. Google, Microsoft, and generic OpenID Connect sign-in now match a verified provider identifier first.
  • Resolved an issue where single sign-on could reject an authorized domain because its letter case differed from the registered domain. Domain matching is now case-insensitive.
  • Resolved an issue where accounts created during identity-provider sign-in were missing from the audit log. Account creation is now recorded.
  • Resolved an issue where a workspace created with Customize lost its template association. It now retains the selected template version for tracking and later updates.
  • Resolved an issue where reloading the template customization wizard could discard edits or lose the selected template. Wizard navigation now preserves the creation context.
  • Resolved an issue where template customization could hide project-secret options or show template-only controls in the workspace wizard. Controls now follow the workspace creation mode.
  • Resolved an issue where editing a copy of a workspace could temporarily change the source workspace's details in the console. The copy now has independent form data.
  • Resolved an issue where opening a workspace or page while signed out could lose the destination during sign-in. Valid destinations are now retained for up to ten minutes.
  • Resolved an issue where the console or API could return incomplete responses over HTTP/2, including behind HAProxy. Responses now complete without the premature connection closure.
  • Resolved an issue where AWS 1-Click VM deployment could fail because its startup data exceeded the EC2 size limit. The startup data is now compressed.
  • Resolved an issue where multiple AWS 1-Click VM deployments could conflict over the SSH key pair name. Each deployment now creates a unique name.
  • Resolved an issue where listing or launching Citrix DaaS resources failed without explaining that the integration wasn't configured. The platform now reports the missing configuration.
  • Resolved an issue where listing or launching Citrix DaaS resources could keep retrying after authorization failed. The platform now retries once and then reports the failure.
  • Resolved an issue where dismissing a setup shortcut could fail without reporting that the user record could not be updated. The platform now returns the update error.
  • Resolved an issue where clusters requiring CPU and memory requests and limits could reject workspace initialization, data bucket jobs, warm-node caching, or platform initialization containers. These containers now specify resources.
  • Resolved an issue where Documentation, What's new, and onboarding help links opened outdated addresses. These links now use the current documentation URLs.

2026.9.4 – October 06, 2026

New features

  • Added support for upgrading internal Percona MongoDB deployments from Percona Operator 1.20.1 to 1.23.0 with an installer-provided upgrade kit. The updated chart also exposes Percona backup configuration for storage targets, schedules, retention, point-in-time recovery, and the database service account used by backup agents.
  • Added support for keyless Google Cloud Storage backups for internal Percona MongoDB on Google Kubernetes Engine using Workload Identity Federation.

Security

  • Updated the workspace sidecar image base packages and containerd to address high-severity vulnerabilities.
  • Updated the NetScaler CPX ingress controller chart from 4.1.17 to 4.2.26 to address known ingress controller vulnerabilities.

2026.9.3 – September 29, 2026

New features

  • Added support for stable specification_id values in Citrix SecurSpaces Flex managed tier definitions. A managed tier version can now keep the same identifier across tenants when Citrix pins the value in deployment values.

General

  • Resolved an issue where successful Citrix SecurSpaces Flex managed tier availability changes and bulk tier-version updates were missing from the audit log. The audit log now records who performed the action, when it happened, and the result.
  • Resolved an issue where the outbound SSH guidance shown in workspaces pointed to the previous documentation URL. The guidance now opens the current SecurSpaces external services documentation.

2026.9.2 – September 28, 2026

New features

  • Added Citrix SecurSpaces Flex support for Citrix-managed workspace specification tiers, including managed tier versions, lifecycle labels, workspace update prompts, and bulk tier-version updates.
  • Added REST API support for managing VSCode versions at platform, organization, and project scope. The API can list, import, rename, delete, and set defaults for versions, and manage platform-level VSCode registries.

General

  • Resolved an issue where Helm upgrades with the internal Percona MongoDB deployment could regenerate database passwords and leave platform services unable to authenticate. Server-side upgrades now reuse existing passwords unless an operator sets a new value, and credential changes roll the services that consume them.
  • Resolved an issue where a workspace could stay on an old sidecar image after a platform upgrade without showing an update prompt. Workspaces now show an update when the stored sidecar image differs from the version shipped by the deployment.
  • Resolved an issue where project People > More details could open the wrong user details route or show the wrong organization in breadcrumbs. The project user details flow now keeps the project and organization context aligned.
  • Resolved an issue where release service images could have different manifest digests depending on the regional registry used. Future release images now use consistent compressed layers across release regions.
  • Resolved an issue where concurrent Kubernetes updates could cause workspace start, restart, or edit operations to fail with a StatefulSet conflict. StatefulSet updates now retry on conflicts.

2026.9.1 – September 21, 2026

General

  • Resolved an issue where a workspace stopped for exceeding its memory limit reported Reason: Unknown and advised updating the workspace image. The failure is now reported as OOMKilled, with memory-specific guidance.
  • Resolved an issue where SCIM provisioning stored a user's email address as both the given name and the family name. name.givenName and name.familyName now map to the user's name.
  • Resolved an issue where marketplace extensions preconfigured in a workspace template were not installed.
  • Resolved an issue where a searchable multi-select list cleared the search text while the user was typing.
  • Updated the default workspace image to 2.3.9.

2026.9.0 – August 13, 2026

Security

  • Updated dependencies and images to address known vulnerabilities.
  • Resolved an issue where some role-protected API requests could bypass access checks.
  • Resolved an issue where some flows could accept the wrong token type.
  • Resolved an issue where user-management actions could affect users outside the caller's scope.
  • Resolved an issue where local secrets could be copied without verifying container ownership.
  • Resolved an issue where sidecar file streaming could expose unintended workspace files.
  • Resolved an issue where sidecar Git handling could accept unsafe command arguments.
  • Resolved an issue where workspace Docker access was broader than required.
  • Resolved an issue where the image builder ran with more privilege than required. It now uses rootless BuildKit.
  • Removed test license keys from production images.
  • Rotated credentials that had been committed to the repository, and added operator recovery guidance.
  • Hardened the AWS Mount Point lifecycle, including attach, update, and delete.
  • Hardened mount point handling: storage classes without TLS are hidden, deletion from the recycle bin is blocked, and error messages no longer disclose internal detail.
  • Hardened the documentation served from the control plane at /docs/.

New features

  • Added AWS Mount Point support for Amazon EFS and Amazon S3 Files storage.
  • Added a redesigned IDE extension sidebar with repositories, mount points, and workspace apps.
  • Added connection quality monitoring in the IDE status bar.
  • Added user, project, and workspace metadata on AI requests forwarded to an AI Gateway.
  • Added AI Gateway health checking with a configurable fail-open behavior.
  • Added a sample Grafana dashboard for AI usage and token consumption reporting.
  • Added desired state configuration tracking of the template version used by each workspace.
  • Added template version status indicators and an Associated Workspaces window with CSV export.
  • Added a workspace update flow that aligns a workspace with the default template version.
  • Added archive and restore for workspace templates that still have associated workspaces.
  • Added dot files in Profile > Configuration for personal workspace setup.
  • Added a Setup Checklist on project pages for guided onboarding.
  • Added deleted workspace recovery during the configured retention period.
  • Added Helm support for applying a platform license during deploy or upgrade.
  • Added HAProxy ingress support and optional cert-manager Certificate rendering.
  • Added GitHub Copilot support for workspaces behind an AI Gateway.

General

  • Updated the product interface and email templates to use the Citrix SecurSpaces product name.
  • Resolved an issue where data bucket uploads could start from ineligible workspaces.
  • Resolved an issue where data bucket upload status could be misleading.
  • Resolved an issue where the data bucket upload modal could show stale bucket data.
  • Resolved an issue where image import could use the wrong credential or image URL.
  • Resolved an issue where a failed image import could become the default image tag.
  • Resolved an issue where workspaces could start with the wrong container image tag.
  • Resolved an issue where reused image tags could leave stale workspace image content.
  • Resolved an issue where VSCode version settings could be lost in workspace flows.
  • Resolved an issue where a private VSCode registry URL could remain stale.
  • Resolved an issue where signed Git operations could fail with commit.gpgsign=true.
  • Resolved an issue where workspace startup could stall during system startup scripts.
  • Resolved an issue where workspaces could stay in Pending because of storage settings.
  • Resolved an issue where a stale sidecar IPC socket could cause CrashLoopBackOff.
  • Resolved an issue where workspace schedules with a 00:00 start time did not save.
  • Resolved an issue where manual Run actions were not counted as activity.
  • Resolved an issue where Profile page SSH addresses could omit the workspace region.
  • Resolved an issue where organization role checks did not apply to protected pages.
  • Resolved an issue where disabled role references could disrupt project loading.
  • Resolved an issue where the Disable Role modal showed -1 instead of a placeholder.
  • Resolved an issue where Connect to GitHub did not start OAuth for new users.
  • Resolved an issue where workspace template version drafts could sort unpredictably.
  • Resolved an issue where create-from-existing showed incorrect specification values.
  • Resolved an issue where HTTP and SSH connected service selections did not persist.
  • Resolved an issue where workspace specification template restrictions could be lost.
  • Resolved an issue where workspace update actions appeared when no update was available.
  • Resolved an issue where template lifecycle actions could leave orphaned workspace state.
  • Resolved an issue where Add to Favorite stayed open after selection.
  • Resolved an issue where the audit page Select All filter option did not apply.
  • Resolved an issue where AI dashboard token totals were inconsistent.
  • Resolved an issue where AI traffic from SSH workspaces lacked observability metadata.
  • Resolved an issue where 1-click demo deployment could fail in common retry scenarios.
  • Resolved an issue where read-only AWS mount points could not be mounted.
  • Resolved an issue where Azure Files mount points had several defects affecting attach and update.
  • Resolved an issue where a workspace could briefly report a DESTROYED state while it was being created.
  • Resolved an issue where the workspace wizard could become stuck after Discard.
  • Resolved an issue where editing a workspace specification did not reach running workspaces, pods, and templates.
  • Resolved an issue where replacing a specification template could write outside its intended scope.
  • Resolved an issue where Community Edition license activation could fail.
  • Resolved an issue where the Insights resource usage chart showed gaps, unstable colors, and an inaccurate tooltip.
  • Resolved an issue where updating workspace properties could cause a backend error.
  • Resolved an issue where the workspace update dialog showed the wrong state for a template version.
  • Resolved an issue where authorizing an SSH key did not list workspaces the user owns without the manage permission.
  • Resolved an issue where invalid repositories were included in the duplicate path check.
  • Resolved an issue where searching for users responded slowly.
  • Resolved an issue where image build logs could not be streamed.
  • Resolved an issue where image builds could fail when the cluster used an external proxy.
  • Resolved an issue where the platform did not recover promptly after losing its leader election lock.

Citrix SecurSpaces 2026.4 includes the following fixed issues

2026.4.10 – August 24, 2026

Security

  • Updated Helm chart security contexts to disallow privilege escalation for platform service containers and the syslog permissions init container.

General

  • Resolved an issue where SCIM user responses did not include group membership and SCIM group list responses omitted members unless a specific group was requested. /Users now returns direct group membership and /Groups list responses include members.

2026.4.9 – August 14, 2026

New features

  • Added HAProxy ingress support.

General

  • Resolved an issue where project creation could fail after the Project Owner role was disabled.
  • Resolved an issue where Azure 1-click demo deployment could fail and leave incomplete network rules.
  • Resolved an issue where NetScaler ingress could fail on Google Cloud.
  • Resolved an issue where Google Kubernetes Engine 1.35 probes could time out too quickly.

2026.4.8 – July 20, 2026

Security

  • Updated dependencies and images to address known vulnerabilities.

New features

  • Added REST API support for managing workspace template Quickstart links.
  • Added REST API support for Custom Access Items on workspaces and templates.

General

  • Resolved an issue where template REST API responses omitted setup scripts.
  • Resolved an issue where VSCode registry records could be missed or left stale.

2026.4.7 – July 2, 2026

Security

  • Updated dependencies to address known vulnerabilities.

New features

  • Added SecurSpaces documentation served from the control plane at /docs/ for air-gapped deployments.
  • Added IDE extension API support for personal workspace endpoints and VSCode version fields.

General

  • Resolved signed Git commit failures when commit.gpgsign=true was set.
  • Resolved JFrog artifact repository access failures for users without a configured token.
  • Resolved an issue where CPU and memory resource limits could be lost after workspace edit operations.
  • Resolved an issue where Create Workspace API responses could miss expected fields.
  • Resolved an issue where attached repositories were missing from personal workspace API responses.
  • Resolved an issue where IDE extension quick-link sign-in did not redirect to non-project routes.

2026.4.6 – June 9, 2026

Security

  • Updated the Go runtime and build toolchain to address known vulnerabilities.

New features

  • Added AI Gateway routing support via Helm values for selected AI service domains.
  • Added X.509 certificate authentication for SecurSpaces connections to external MongoDB deployments.

General

  • Resolved outbound SSH connections closing without explanation when no SSH method was configured.
  • Resolved an issue where the add icon on the empty home page create card appeared flattened.
  • Resolved an issue where Pendo in-app guide sessions could continue after logout.

2026.4.5 – June 4, 2026

Security

  • Resolved JFrog anonymous tokens accepted during OAuth sign-in.

General

  • Resolved a nil panic in the OAuth client secret rotation job when no OAuth application was configured.
  • Resolved an issue where the auto-delete action used an incorrect workspace last-used time.
  • Resolved GPU configuration options being hidden for the security officer role in workspace templates.

New features

  • Added workspace Docker registry mirror support via workspaceDockerRegistryMirrors Helm value.

2026.4.4 – May 29, 2026

Security

  • Upgraded Go and Docker toolchain versions to address known vulnerabilities.
  • Updated the MongoDB container image to address known vulnerabilities.
  • Bumped the default workspace image to 2.3.6 to address known vulnerabilities.

General

  • Resolved an issue where the "update available" icon persisted after a workspace update completed.
  • Resolved non-deterministic color assignment in Resource Allocation charts. Colors now sort by region.
  • Resolved an issue where Custom Actions conditions were not applied correctly.
  • Resolved an issue where the Profile page showed an error on refresh for Developer role users.
  • Resolved incorrect units for memory and disk when editing resource limits.
  • Resolved workspace status records not initialized for cloned or template-created workspaces.
  • Resolved the Advanced dropdown appearing empty for some roles in workspace settings.

2026.4.3 – May 12, 2026

General

  • Resolved a Kubernetes cluster cost issue caused by warm node pre-provisioning.
  • Resolved an image pod caching issue by re-aligning node anti-affinity to kubernetes.io/hostname.

New features

  • Added a platform setting to configure a custom upstream URL for the VS Code Extensions Gallery.
  • Increased the maximum configurable workspace specification limits for CPU, GPU, memory, and disk.

SecurSpaces 2025.10 includes the following fixed issues

2025.10.21 – April 30, 2026

Security

  • Resolved an issue where a rejected workspace SSH approval still authorized the presented public key, allowing a later connection with the same key to succeed. SSH keys are now authorized only when the approval request is accepted.
  • Tightened file and directory permissions in the installer. Generated directories, Terraform variable files, and the CA certificate bundle are now created with owner-only access to address Mend SAST findings (CWE-732).
  • Updated the MongoDB container image to address known vulnerabilities reported by Mend.
  • Bumped the default workspace image to 2.3.6 to address known vulnerabilities.

General

  • Resolved slow query performance for ip_pod_assignment and workspaces_v5 collections that could lead to proxy OOMKilled events. Added a compound index on (ip, region_id) for ip_pod_assignment and a team_id index on workspaces_v5.
  • Resolved a delay when switching to the Workspaces tab in the user interface.
  • Resolved an issue where the table component did not show its loading state on initial data fetch.
  • Resolved an issue where the copy-to-clipboard tooltip did not appear on the first hover or copy action.
  • Resolved an issue where opening a terminal session from the dropdown launched a duplicate window instead of focusing the existing one.

2025.10.20 – April 23, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.
  • Updated the Go language runtime to version 1.25.9 and resolved frontend CVEs reported by Mend.

General

  • Resolved an issue where workspace setup scripts were lost when a workspace was created through the REST API. Setup scripts are now preserved on create.
  • Resolved a UI issue where the workspace access item icon appeared taller than expected.

2025.10.19 – April 14, 2026

General

  • Resolved an issue where 1-Click VM provisioning failed when targeting an existing Azure Resource Group.

2025.10.18 – April 13, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

General

  • Resolved an issue in the OAuth2 authentication flow where email addresses containing uppercase letters caused authentication failures or account mismatches.

2025.10.17 – April 1, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

2025.10.16 – March 30, 2026

General

  • Resolved a critical CosmosDB index error that caused backend upgrade failures. This fix ensures that database schema updates and indexing operations complete successfully during platform deployments, preventing service disruptions during the upgrade cycle.
  • Added GPU-accelerated workspaces with hardware acceleration for machine learning, data science, and graphics-intensive workloads.

2025.10.15 – March 17, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

2025.10.14 – March 9, 2026

Networking

  • Resolved an issue where cross-workspace HTTP access was broken.

2025.10.13 – February 19, 2026

General

  • Resolved an issue with Git Large File Storage (LFS) that affected GitLab repositories when using SSH for authentication.

2025.10.12 – February 11, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

2025.10.11 – February 11, 2026

General

  • Resolved an issue where a misleading error message was generated by the measurement cron job for workspaces with no active pods, such as those in a paused state.

2025.10.10 – January 30, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

2025.10.9 – January 28, 2026

General

  • Resolved an issue with the VS Code Extensions Gallery that prevented the discovery and installation of extensions.

New features

  • Upgraded the NetScaler Ingress Controller (NetScaler CPX) from version 3.2.22 to 3.3.2. This update provides improved stability and higher performance for ingress traffic management.

2025.10.8 – January 23, 2026

Security

  • This release includes several vulnerability fixes across the platform's core services.

2025.10.7 – January 15, 2026

Security

  • Refactored the Helm Chart RBAC configuration to enhance the platform's security posture through least-privilege principles. The previously unified ClusterRole has been split into two specific scopes: Namespace-scoped Role manages workload-specific resources, including pods, jobs, and secrets; Minimal ClusterRole is restricted to essential cluster-wide resources, such as nodes, storage classes, and metrics.

2025.10.6 – December 18, 2025

General

  • Fixed a bug in 1-click VM environments using OAuth integration that prevented local IDEs from successfully connecting via SSH extensions and plugins. This resolution ensures that developers can use local IDE tools, such as VS Code Desktop or JetBrains Gateway, within the authenticated workspace session.

2025.10.5 – December 15, 2025

General

  • Added support for F5 NGINX annotations. Platform administrators can enable dedicated controller support with platform.useF5NginxController: true.

Security

  • Updated the Go language runtime to version 1.25.5, which addresses known security vulnerabilities.

2025.10.4 – December 2, 2025

General

  • Fixed a permission issue that prevented users with the security officer role from disabling analytics features on the platform configuration settings page.
  • Resolved an issue causing the Workspace API component to enter a CrashLoopBackOff state when the system was managing a large number of active or decommissioned workspaces.

New features

  • Added a new configuration option to disable Amazon EKS auto-mode detection during cluster setup. Administrators can set region.clusterConfig.disableAutoModeCheck: true for more granular control in specific deployment environments.
  • Introduced Terraform support for managing user groups, allowing administrators to provision, update, and manage workspace user groups using Infrastructure as Code practices.

2025.10.3 – November 26, 2025

General

  • Fixed an issue where some Visual Studio Code dependencies failed due to an underlying C standard library requirement. The minimum required glibc version is now 2.28 to ensure stability and compatibility with remote VS Code functionality on supported Linux distributions.

Security

  • Updated the Go language runtime to version 1.25.4, which addresses known security vulnerabilities.

2025.10.2 – November 21, 2025

General

  • Resolved slow database migration performance. An optimization to the database migration engine significantly reduces the time required to run database updates during product rollouts and version upgrades.

2025.10.1 – November 14, 2025

General

  • Removed the dependency on the C standard library (libc). The core workspace components no longer require libc at runtime.