Captivo Access changelog — 2026 · Page 6 of 13

What changed

• Fixed: Enable KasmVNC seamless clipboard so the DLP policy is observable

What changed

• Fixed: Make the bundle command resilient across install/update/re-pair
• Fixed: Chown guacd volumes with the pinned guacd image, not busybox

What changed

• Fixed: Prune dangling images in the bundle command to prevent disk exhaustion

What changed

• New: Return clipboardMode in the hi-fi isolated descriptor
• New: Per-session KasmVNC clipboard DLP config in the broker
• New: Map clipboardMode to KasmVNC DLP flags on the broker call

What changed

• New: Route KasmVNC WS to per-session broker port, drop single-flight
• New: KasmVNC in-container concurrency broker (hub + per-session)

What changed

• Fixed: Keep KasmVNC RFB WebSocket under /kasm-tunnel

What changed

• Fixed: Pass site id to KasmVNC hi-fi tunnel iframe

High-fidelity isolated browser (beta)

The Pro Isolated browser gains a Streaming quality setting per resource:

• Standard (default) — the existing transport; works in any network.
• High-fidelity (beta) — a modern codec (KasmVNC) for noticeably smoother scrolling and video, streamed over a single WebSocket through your connector (no extra ports, no TURN — data stays on-prem).

Choose it per resource when you add/edit an Isolated browser. High-fidelity is beta and not yet recorded (session recording for it is coming). Standard and remote-desktop (RDP/SSH/VNC) access are unchanged.

To use: enable it on a resource, then update your gateway connector so it pulls the new high-fidelity browser image, and route /kasm-tunnel on your reverse proxy (see docs).

What changed

• Fixed: Connector install/update pull the latest browser image (no stale :latest)

What changed

• Fixed: Clear stale X lock/socket on display reuse (intermittent blank-session hang)

What changed

Fixes and refinements — see the changelog below for details.

Isolated browser: clipboard control + recording

Two hardening additions for the Pro Isolated browser:

• Block clipboard copy-out. Each isolated-browser resource now has a Clipboard setting (Allow / block copy-out / block paste-in / block both). "Block copy out" stops a vendor from copying text out of the isolated browser to their own machine — enforced server-side by the session engine, not a browser trick.
• Session recording works for isolated browsers too: turn on Record sessions for the resource and the session is captured and plays back under Recordings, same as remote-desktop sessions.

Manager-only update; no gateway/connector change needed.

Isolated browser: concurrent sessions

The Pro Isolated browser (Remote Browser Isolation) now supports multiple vendors at the same time, not just one.

• Each isolated session gets its own fresh, throwaway browser inside the on-prem container — separate profile, separate screen — so concurrent vendors never share state.
• Capacity is capped per gateway host by MAX_SESSIONS (default 5); once full, an extra vendor is told to try again shortly. Raise it on a bigger host, or add more gateway connectors to scale further.
• Sessions are cleaned up automatically when they end (and a safety timeout reaps any that are abandoned).

Still opt-in via ISOLATED_ENABLED. Transparent web and remote-desktop (RDP/SSH/VNC) access are unchanged. Update the browser image on your gateway connector to get this.

Pro preview: Isolated browser (Remote Browser Isolation)

A new Isolated browser resource type opens an internal web app inside a throwaway browser that runs on-prem next to the connector — only its screen reaches the vendor, so nothing (cookies, downloads, page data) lands on the vendor's device. It reuses the same identity, grant, audit, and recording pipeline as remote-desktop sessions.

• Add a resource of type Isolated browser (Pro) and point it at an internal URL; the vendor opens it as a streamed, contained session.
• The browser runs in the customer's network — data stays on-prem (KVKK/5651-friendly).
• Opt-in and off by default: set ISOLATED_ENABLED=1 on the manager to enable it. The captivo-browser container ships with the gateway connector.

Preview scope: this first release supports one isolated session at a time (a second concurrent open is rejected while one is active). Multi-session concurrency and data-transfer controls come in follow-up releases. Transparent web and remote-desktop (RDP/SSH/VNC) resources are unchanged.

Fixed: SSH remote-desktop file uploads ("Unable to write to file")

Uploading a file during an SSH gateway session failed with "Unable to write to file." The cause: uploads were being written to the remote server's root directory (/), which a normal SSH user can't write to. (RDP was unaffected.)

• Uploads now go to the login user's home directory by default — no configuration needed.
• Each SSH resource gains an optional "SFTP upload folder" field, so you can point uploads at a specific absolute path on the target when the home directory isn't what you want.
• Downloads and everything else are unchanged.

Scheduled jobs now run automatically — no host cron

Self-hosters no longer need to touch the host's crontab. The Compose stack now includes a small access-cron container that runs the manager's background jobs for you — health checks every few minutes, and audit/recording retention plus the audit-anchor once a day — talking to the manager over the internal network.

• Zero host setup: works on any host, even ones without cron installed. restart: unless-stopped means it self-heals after a reboot.
• More reliable: no dependency on public DNS/TLS being reachable from the host — the jobs run inside the stack.
• Watch them with docker logs access-cron.

Upgrading: re-pull the deploy/ folder and run docker compose -f deploy/docker-compose.prod.yml up -d. If you'd previously added the jobs to your host crontab via an older setup.sh, re-running ./setup.sh removes that legacy block so nothing runs twice.

Insights now measures access, not raw traffic

The Insights charts previously counted every HTTP request, so a single web session inflated the numbers into the thousands. They now report real access.

• "Active vendors — 30 days" (renamed from "Access — 30 days") shows the number of distinct vendors who accessed each day, with a separate line for vendors who were blocked.
• Top resources and Top vendors now rank by days active — how many days each was actually used — instead of by request volume, so a chatty web app no longer dominates the list.
• Access type mix counts distinct vendor↔resource pairs, so web and remote are compared fairly.
• The hourly chart is relabelled "Traffic by hour" to reflect what it shows.
• The page is faster and lighter, and the duplicate Site health / Recent activity panels were removed (they already live on the Console).

Redesigned admin header menus

The console's Infrastructure and People header menus are now card megamenus — easier to scan and find what you need.

• Each menu opens as a dark panel of labeled columns; every item is a card with an icon, name, and a one-line description of what it does.
• Infrastructure is grouped into Connectivity, Identity & access, and Platform; People into Team & sessions — so related settings sit together.
• The current page's item is highlighted, and the account (avatar) menu now matches the dark header for a consistent look.
• On small screens the mobile menu shows the same groups and sub-headings. Menus still open on click and close on Escape or click-away.

Vendor portal brand refresh

The vendor access portal header now shows the refreshed Captivo Access brand lockup — the same orbit mark and wordmark used across the rest of the app — replacing the old placeholder logo, so the portal looks consistent everywhere your vendors see it.

Redesigned sign-in

The login screen has a new look and a clearer, guided flow.

• New dark, centered sign-in card with the refreshed Captivo Access brand lockup — consistent across sign-in, first-run setup, account recovery, and invite acceptance.
• Guided passkey flow: a three-step indicator walks you from sign-in → passkey verification (with a live "waiting for your passkey" prompt) → an access-ready screen.
• "You're in" summary: right after signing in, you see the sites you currently have access to — each tagged Remote or Web with its access window — and a single Go to my access button.
• Sign-in stays one tap with your device passkey (no username or password), and SSO sign-in is unchanged.

What changed

• New: Adopt keyhole-orbit logo + Captivo/ACCESS lockup + gradient favicon

What changed

• New: Make access-request justification required/optional via policy

What changed

Fixes and refinements — see the changelog below for details.

What changed

• Fixed: Urgent (amber) window color only in the final hour, not under 24h

What changed

• Fixed: Access window bar shows remaining time (depletes toward expiry)