Captivo Access changelog — 2026 · Page 4 of 13

Directory connector fix

Fixes a confusing failure where the LDAP/Active Directory Test connection kept reporting "connector offline" even though a connector was online.

Fixed

• Directory test no longer breaks when a connector is deleted. The directory pointed to a connector by a plain id that was never cleared when that connector was removed, so every directory test failed with "connector offline" against a connector that no longer existed. The link is now managed properly and clears itself automatically when a connector is deleted.
• Clear warning when the chosen connector is gone. If the connector your directory used has been deleted or revoked, the settings page now shows a visible warning and asks you to pick a current one — instead of silently showing the first connector while still using the missing one behind the scenes.
• Saving a directory config validates the connector. Selecting a connector that no longer exists is rejected with a clear message rather than failing silently.

Selectable RDP security mode

Remote-desktop (RDP) resources now let you pick the security mode — Automatic (default), NLA, TLS, or RDP (legacy) — on the resource form.

This fixes RDP sessions that started failing with "the server refused the connection" after a Windows update: newer/updated Windows hosts often require NLA, which the previous automatic negotiation couldn't always satisfy. Set the resource's RDP security to NLA and it connects again. Existing resources keep the automatic behavior unless you change it.

Consistent live-session cards on the dashboard

The Live sessions widgets (remote desktop, isolated browser, and web app) now share one consistent card layout — equal height, aligned buttons, and a uniform header row — instead of rendering at different sizes.

Captivo Access 1.0

The first stable release of Captivo Access — open-source, self-hosted Zero-Trust remote access for third-party vendors and contractors. No VPN, no agent on the vendor's machine, no inbound port on your network: an outbound-only connector brings your internal apps to an identity-checked browser session.

What 1.0 delivers

Three ways to reach an internal resource, all through the browser:

• Web apps — an identity-aware reverse proxy; the vendor signs in with a passkey, you approve, they reach the app.
• Remote desktops (RDP / SSH / VNC) — a native in-browser gateway (guacd); credentials are injected server-side and never shown to the vendor.
• Isolated browser — a throwaway, server-side browser (KasmVNC); only pixels reach the vendor, nothing lands on their machine. Now handles self-signed internal targets too.

Governed sessions:

• Grants, approval workflows, and time-of-day schedules gate every session.
• Session recording for all three methods, encrypted at rest, replayable in the console.
• A searchable keystroke timeline for gateway sessions — jump to the moment a command was typed, and search recordings by command.
• Live watch, take-control, and terminate for in-progress sessions.
• A tamper-evident audit trail with optional external RFC-3161 timestamping.

Hardened by design:

• The connector dials out only, never listens, and carries an optional egress allowlist.
• Passkey (WebAuthn) sign-in, per-resource DLP (clipboard, file transfer, screen watermark), and constant-time internal-service auth.
• One-command connector install brings up the connector and both session engines together.

Thank you to everyone who tested along the way. Onward to 1.x.

Fix: white box behind the notification bell

The notification bell icon in the header showed a small white background box. It's now transparent, sitting cleanly in the header in both light and dark themes.

Notification panel now follows your theme

The notification bell dropdown (added in the previous release) used fixed dark colors and looked off in both light and dark mode. It now adapts to the active theme — light on light, dark on dark — with the "down"/"recovered" labels colored to match.

Notification bell dropdown

Clicking the notification bell in the header now opens a quick panel instead of jumping straight to the notifications page. From the panel you can:

• Glance at your most recent unread notifications
• Mark one (or all) as read, or delete one
• Jump to the full notifications page with "View all notifications" when you want

Opening the panel doesn't mark anything read on its own — the unread count only changes when you act on a notification.

Fix: isolated browser blank screen after an unclean host shutdown

If the connector host was power-cut or crashed while an isolated-browser session was open, the isolated-browser engine could fail to restart cleanly — leaving a stale display lock so its web port never came back up, and every isolated-browser session showed a blank screen (gateway and web-app access were unaffected).

The engine now clears stale display locks on startup, so it recovers on its own after an unclean shutdown — no manual intervention needed.

Note: this updates the isolated-browser engine, so update the connector (Re-pair / Update in the console) for the fix to take effect.

Quieter isolated-browser engine logs

The isolated-browser engine (KasmVNC) log no longer fills with harmless Chromium noise — D-Bus connection failures and Google push-registration errors — that appeared on every session. These were never a problem, just clutter that made real messages harder to spot.

Note: this updates the isolated-browser engine, so update the connector (Re-pair / Update in the console) for it to take effect.

Isolated browser: open internal HTTPS targets with self-signed certificates

Isolated-browser Resources can now open internal HTTPS apps that use a self-signed or internal-CA certificate — Proxmox, iDRAC/iLO, router/switch panels, self-hosted tools. Previously the isolated browser rejected these certificates and the page wouldn't load (the engine log filled with TLS handshake errors).

• Turn on "Allow self-signed certificate (skip TLS verification)" on the isolated Resource. Off by default — existing Resources keep verifying certificates.
• Only the connector → target leg skips verification, inside your network, for that one Resource.

Note: this includes an updated isolated-browser engine, so update the connector (Re-pair / Update in the console) for it to take effect.

Fixes

• The isolated-browser engine no longer logs a spurious error when a session closes.

Documentation & setup accuracy

A pass over the docs and the shipped deploy files to match how connectors actually work, plus small in-app copy fixes.

• Connectors are gateway- and isolated-capable out of the box. The docs and the "Add connector" screen no longer imply a "gateway host" toggle — every connector's install command deploys the remote-desktop engine (guacd, for RDP/SSH/VNC) and the isolated-browser engine (KasmVNC) alongside it. One command, nothing to enable.
• Shipped deploy now exposes the remote-session, isolated-browser, and vault feature flags (NATIVE_GATEWAY, ISOLATED_ENABLED, VAULT_ENABLED) in docker-compose.prod.yml / .env.prod.example, so a fresh install can turn them on the same way as session recording.
• Corrected an isolated-resource watermark hint, several stale references, a broken doc link, and the quickstart's single-box connector command and cleanup steps.

Search recordings by typed commands

The Recordings page has a new Search commands box next to the host search. It finds recorded gateway sessions by the commands typed inside them — e.g. search rm -rf or systemctl to jump straight to the sessions where they were run, instead of opening recordings one by one.

• Works alongside the existing vendor / resource / date filters (combine them to narrow results).
• Masked entries (passwords typed after sudo, su, passwd) are never searched.
• Commands stay encrypted at rest; search decrypts only in memory, on demand.
• On a very large history, the search asks you to narrow by vendor, resource, or date rather than running an expensive scan.

Runtime hardening

Deployment-layer hardening. No action needed and no behavior change for users.

• Security response headers are now sent on every page: HSTS, clickjacking protection (X-Frame-Options), MIME-sniffing protection, a tighter Referrer-Policy, and a Permissions-Policy that disables camera/microphone/geolocation.
• The manager now runs as a non-root user inside its container, reducing the blast radius of any future container issue.
• Containers run with no-new-privileges, and the manager and data-plane drop all Linux capabilities.

Security hardening

A security pass across the manager, data-plane, and connector. No action needed — these strengthen defense-in-depth and are backward-compatible.

• Rate limiting can no longer be bypassed by a spoofed client IP. Login, passkey, account-recovery, connector-enrollment, and the connector tunnel now key their limits on the real client address, so an attacker can't rotate a header to evade the limit or forge a victim's address to lock them out.
• Isolated-session file transfer now re-checks the access grant. Downloading, uploading, or listing files for an isolated resource requires a currently-valid grant, matching the check already enforced when opening a session.
• Session recordings and playback are protected against oversized/abusive input (bounded WebSocket reads and ingest sizes) so one client can't exhaust the shared data-plane.
• Connector hardening: the connector caps how many streams it services at once, always refuses to reach cloud-metadata/link-local addresses, and warns if configured with a non-TLS URL.
• Internal service-to-service secrets are now compared in constant time, and session cookies carry the Secure flag.

Central keystroke-logging policy

Keystroke logging (the SSH/RDP typed-input timeline) is now governed tenant-wide from Policy → Session recording, instead of only per resource:

• Off — disabled for all resources.
• Per resource (default) — each resource decides, as before.
• Required — forced on for every gateway session that is recorded; a resource cannot turn it off. Useful for a compliance mandate that every privileged session's commands are logged.

Applies only to sessions where recording is enabled. Password masking (after sudo, su, passwd) and encryption at rest are unchanged. Existing deployments keep their current per-resource behavior until an admin changes the policy.

Session keystroke timeline (SSH + RDP)

Gateway session recordings now include a searchable timeline of typed commands and input next to the player. Click any entry to jump straight to that moment instead of scrubbing through the whole session.

• Enable it per resource (session recording must be on).
• Passwords typed after sudo, su, or passwd are masked.
• The timeline is encrypted at rest, like the recordings themselves.

Fixes

• Isolated browser recordings wouldn't play. Recordings of isolated (browser-isolation) sessions could open to a black screen with a disabled Play button. The finalized video was stored inconsistently with the at-rest encryption flag, so the player couldn't decode it. New recordings are now stored correctly, and existing affected recordings have been repaired.

Isolated browser logs show the engine is alive

The isolated-browser engine (KasmVNC) now logs a startup line, so the connector page's "Isolated browser logs" section confirms the engine is running as soon as it starts — instead of looking empty until the first isolated session.

Connector-side change only (the isolated-browser image). Re-run the gateway host's install command to pick it up. No central update needed.

Isolated browser logs on the connector page

A gateway connector's detail page now shows an "Isolated browser logs" section next to "Gateway logs" — the session-lifecycle log from the isolated-browser engine (KasmVNC), so you can troubleshoot isolated sessions from the console.

• The broker now logs session opened/closed, capacity refusals, and stale-session reaps.
• The connector tails these and reports them, the same way it already does for guacd.

Requires re-running the gateway host's install command so the new log volume is mounted; until then the section shows a hint. The data-plane needs no change beyond the image update.

Cleaner activity feed for web-app sessions

The console's activity stream no longer floods with a separate entry for every request a web app makes. A busy internal app (e.g. Proxmox, which polls many times a second) used to show dozens of "accessed X" lines for a single visit.

• Web-app sessions now show a single "connected to X" entry, matching how remote-desktop and isolated-browser sessions already appear.
• The per-request detail is unchanged in the audit log, CSV export, and tamper-evident chain — only the glanceable feed is de-noised.

All session recordings encrypted at rest

Session recordings are now encrypted at rest (AES-256-GCM) for all session types. Remote-desktop recordings were already encrypted; web-session (rrweb) and isolated-browser (video) recordings are now encrypted too.

• New recordings are encrypted automatically — no configuration needed.
• Existing recordings still replay unchanged (each recording is read according to how it was stored).

Cleaner vendor view + emails

• Denied resources no longer appear in a vendor's access list. They already showed expired/revoked entries as hidden; declined ones are now hidden too — so vendors only see what they can actually reach, and the admin's internal denial note is never exposed. (Vendors are still notified by email when their own request is declined.)
• Removed a tagline line from the footer of platform emails.

More resilient sessions on unstable networks

Long-lived remote-desktop (RDP/SSH/VNC) and isolated-browser sessions are less likely to drop after a brief network hiccup.

The connector tunnel previously tore itself down if a single keepalive couldn't be written within 10 seconds — so a short stall on the connector's internet uplink could kill a session that had been open for hours. The tolerance is now 30 seconds (tunable via TUNNEL_WRITE_TIMEOUT_SECS).

This does not make sessions survive a real, sustained outage (a stateful RDP/SSH session still ends if the tunnel truly drops) — it removes the spurious drops caused by momentary blips.

Update both the data-plane and the connector for the full effect.

Session control panel + on-screen keyboard

Remote-desktop (RDP/SSH/VNC) and isolated-browser sessions now have a modern, built-in control surface.

• Control panel — a collapsible panel docks to the left edge: Full screen, Clipboard status, Upload (isolated), and Leave session, all in one place instead of scattered buttons.
• On-screen keyboard — a full keyboard docks to the right edge: F-keys, arrows, navigation cluster, and sticky Ctrl/Alt/Shift so you can send combinations like Ctrl+Alt+Del to a Windows session — from any browser, no physical shortcut needed.
• Recording and "being monitored" notices stay always visible.
• Also: the Resources screen no longer says "site" in a few leftover spots.

No connector update needed — this ships with the manager.

Isolated browser on phones

Isolated-browser sessions now work from a phone (and other touch devices).

• On a touch device the session is sized to the phone's screen, so the internal web app renders its mobile layout — legible and finger-friendly instead of a shrunken desktop.
• Tap, scroll, and drag work natively; a small on-screen bar adds a keyboard toggle (raises your phone's keyboard so you can type into the page) plus Esc, Tab, arrow keys, and Ctrl for the things web apps need.
• Desktop sessions are unchanged.

Sessions render on the connector/gateway host, so this takes effect once that host is updated to the new image.

Hardening for isolated-browser file transfer

Follow-up fixes to the isolated-browser file transfer added in v0.77.0:

• Security: transfer filenames are now rejected if they contain control characters, closing a header-injection vector in the transfer relay.
• Audit: file uploads now record the actual number of bytes transferred (previously logged the acknowledgement size).

No configuration change. The data-plane carries these fixes; update it before enabling file transfer on any Resource.