Release 2026.2

Release 2026.2.110

Availability: 31 Jul 2026

New features

• Hyper-V cloud-init support CMP-3409
  • Hyper-V resource handlers now support cloud-init for customizing Linux guests during provisioning, alongside the existing Sysprep support for Windows guests.
• GitHub App authentication for Source Code Repositories CMP-4026
  • Source Code Repository connections can now authenticate using a GitHub App instead of a personal access token, covering both read/sync and push.
  • App credentials are set at the connection level and are not tied to an individual GitHub account, so access survives personnel changes.
  • Supports both GitHub Cloud and self-hosted GitHub Enterprise Server.
  • Existing personal access token connections continue to work unchanged.

Enhancements

• Scheduled server/resource actions can now be rescheduled directly from the UI. CMP-3948
• OpenShift Virtualization resource handler now supports CPU and memory hardware rate calculation, using the same rates configuration as other resource handlers. CMP-4085
• Sync resources job now runs as a parent job with individual child jobs per blueprint, so a discovery failure on one blueprint no longer prevents the remaining blueprints from syncing. CMP-4075

Bug fixes

• Fixed a stored cross-site scripting (XSS) vulnerability in custom order forms. CMP-4138
• Fixed an issue where Keeper custom fields did not resolve correctly for password values. CMP-3273
• Fixed an issue where canceling a job marked its order as completed with errors instead of canceled. CMP-4083
• Fixed an issue where the Continue button on a paused job, shown on the order details page, did not resume the job. CMP-3420
• Fixed an issue where a blueprint with an optional numeric parameter with a generated option action could not be ordered. CMP-4135
• Fixed an issue where Hyper-V Sysprep and unattend files written to the root of C:\ failed silently on Windows Server 2025. CMP-4131
• Fixed an issue where running a server or resource action in bulk on multiple servers did not respect the action’s custom form. CMP-3951
• Fixed an issue where exporting a blueprint’s parameters omitted global constraints, such as minimum, maximum, and regex values. CMP-3427
• Fixed an issue where AWS Roles Anywhere authentication failed with an “Invalid signature” error on servers whose system clock was not set to UTC. CMP-4076
• Fixed an issue where AWS tagging did not convert a blueprint parameter’s value to a string when the parameter allowed multiple values, causing tag updates to fail. CMP-4094

Release 2026.2.95

Availability: 17 July 2026

New features

• Server Jobs API endpoint CMP-3364
  • A new GET /api/v3/cmp/servers/{id}/jobs/ sub-endpoint returns all jobs associated with a server.
• Opt-in TTL caching for resolved vault secrets CMP-3952
  • Vault-backed secrets (AWS Secrets Manager, Azure Key Vault, CyberArk, HashiCorp Vault, Keeper) can now be cached for a configurable TTL instead of being re-resolved from the backend on every access.
  • Caching is opt-in, so nothing changes until an administrator sets a TTL on the Vault Provider or an individual secret mapping.
  • Manual refresh (for a single secret or all secrets under a provider) is available via the UI and API.

Enhancements

• Ansible connections now support SSH key authentication to the management server, as an alternative to static username/password credentials. CMP-4071
• Custom Forms can now mask password/encrypted values when read via get_cf_values_asdict(), via a new opt-in kwarg (defaults to False). CMP-4073
• Copy File action now works on Windows systems (previously Linux-only). CMP-2829
• Azure Local resource handler: Network names can now be changed. CloudBolt stores the identifier used for API calls separately from the display name. CMP-3412
• SCVMM resource handler now supports Kerberos authentication. CMP-4060
• vSphere resource handler now supports specifying the network adapter type when adding a NIC to a server. CMP-3593

Bug fixes

• Fixed a 504 Gateway Timeout when non-admin users loaded the catalog. CMP-4082
• Fixed an issue in which Acropolis VM provisioning using a custom Sysprep file failed for Windows guests. CMP-4117, CMP-4130
• Fixed an issue where Azure Run Command script execution did not report an error when the underlying script failed. CMP-3253
• Fixed an issue where UI Extensions as Code import failed partway through when the repository contained .png files. CMP-3912
• Fixed an issue where entering a pipe (|) character in templated text fields caused the literal Django filter syntax to leak into rendered output. CMP-4081
• Fixed an issue where importing a duplicate vCenter template from a second Content Library overwrote the original template’s environment assignments. CMP-4078
• Fixed an issue where custom-form order submission could take 30+ seconds; redundant generated-options plugin execution and duplicate validation on submit were removed. CMP-4098
• Fixed an issue where Custom Form orders for Kubernetes Pod blueprints (InstallPodServiceItem) failed because the Environment was missing from the submitted blueprint item arguments. CMP-3902

Release 2026.2.72

Availability: 26 June 2026

New features

• MCP Server Custom Tool Actions
  • Administrators can now create custom MCP Tool Actions that let you define tools for AI agents to discover and invoke directly by name. Custom tools are managed as CloudBolt objects with support for RBAC, source code repository sync, and import/export. Tool visibility is scoped per user by role, and changes take effect without restarting the MCP server. CMP-3939, CMP-4002, CMP-4016
• MCP Server Action Controls
  • Administrators can now control how individual Resource Actions and Server Actions are exposed to AI agents. From a new AI / MCP tab on the action detail page, you can hide an action from MCP, or promote it as a named tool so agents can discover and invoke it directly. CMP-3940
  • MCP Tool Actions, Resource Actions, and Server Actions now support tool annotations. Authors can set a title and behavioral hints, enabling MCP clients to make smarter decisions, such as prompting before destructive actions. Hints default to Unset, so existing tools are unaffected. CMP-4055
• OCI Resource Handler — Flexible Shapes CMP-3909
  • The OCI resource handler now supports ordering flexible shape VM instances.
  • Selecting an image automatically scopes the list to display compatible shapes.
  • Choosing a flexible shape reveals OCPU and memory fields for customization.
• Azure Resource Handler — SSH Key Authentication CMP-3271
  • Azure ARM resource handlers now support SSH public key authentication for Linux VMs.
  • A new Authentication parameter lets you choose between SSH Public Key or Password during provisioning.
  • A new Sync Resource Handler SSH Keys recurring job keeps each environment’s available key list in sync with Azure.

Enhancements

• Nutanix resource handler now supports specifying a storage container when provisioning a VM or adding a disk. CMP-2741
• Hyper-V resource handler
  • VLAN tagging is now supported when adding a NIC to a Hyper-V server during provisioning and Day-2 operations. CMP-4053
  • Image imports now skip individual images that fail to load and continue processing, logging an error for each skipped image. CMP-3921
• LDAP searches now use paged results by default, preventing SIZELIMIT_EXCEEDED errors on large directories. The default page size is 100 entries per request. CMP-3972
• Blueprints with Is Orderable unchecked are now hidden from users who only have deploy permissions. Users with Manage Blueprint permissions continue to see all blueprints. CMP-3950
• OpenShift Virtualization resource handler now scopes network attachment definitions to their namespace, preventing invalid VM network configurations when attachment definition and VM are in different namespaces. CMP-3747
• The installer and upgrader now check that the system umask is set correctly before proceeding, preventing failures on hardened systems with a restrictive umask. CMP-3947

Bug fixes

• Fixed an open redirect vulnerability where HTTP Referer-based redirects were not validated. CMP-3756
• Fixed an issue where ordering an OCI blueprint with a custom form failed with a Fault Domain error. CMP-3905
• Fixed an issue where the MFA setup QR code failed to display or rendered incorrectly in some browsers. CMP-4019
• Fixed an issue where a mandatory field hidden behind a boolean control field was incorrectly flagged as required. CMP-3949
• Fixed an issue where Remote Script actions exported to a Source Code Repository were always given a .py file extension. CMP-4064
• Fixed an issue where the CMP installer failed to start the memcached service on hardened RHEL systems with IPv6 disabled. CMP-3953
• Fixed an issue where users with the Global Viewer role received a 404 when accessing jobs they did not own via the Jobs API. CMP-3901
• Fixed an issue where OS build names in dropdowns for ordering and server management flows were not sorted alphabetically. CMP-3908
• Fixed an issue preventing MCP clients without a pre-configured access token from authenticating to the CloudBolt MCP server. CMP-4054
• Fixed two issues occurring when pushing or refreshing blueprints and actions with shared-module dependencies to a Source Code Repository. CMP-4030
  • Fixed a maximum recursion depth exceeded error that occurred when shared-module dependencies contained a circular reference.
  • Fixed an error that corrupted the identifier of a Shared Module when pushing it to a remote source.
• Fixed an issue where mcp.log was created with incorrect ownership on RHEL systems, which could prevent job engines from starting. CMP-4018
• Fixed an issue where Azure Resource Manager resource handlers for Government and China failed to connect after upgrading to 2026.2.16. CMP-4021
• Fixed an issue where attempts to add a NIC to a network for a Hyper-V resource handler failed when the network name contained spaces or parentheses. CMP-4052
• Fixed an error that occurred when filtering the resource list API by lifecycle status on environments containing resources with unset date or datetime custom fields. CMP-3907
• Fixed issues on the Jobs list page where the search box did not return results, and selecting the Job column header sorted by internal ID rather than the displayed job name. CMP-3956
• Fixed an issue where VMs imported via a Sync VMs job on an OpenShift Virtualization resource handler were not assigned to their namespace’s environment. CMP-4003
• Fixed an issue where the Nutanix resource handler did not retry requests receiving an HTTP 429 (Too Many Requests) response from the Nutanix API, causing sync jobs to fail when the rate limit was hit. CMP-3927

Release 2026.2.44

Availability: 5 June 2026

New features

• Vault Provider Secret Mapping API CMP-3479
  • A new REST endpoint at /api/v3/cmp/vaultSecretMappings/ enables programmatic management of vault secret mappings. Mappings associate a vault provider with a specific instance, such as a Resource Handler, Connection Info, IPAM, or ITSM, and define which vault secret is used to resolve a given attribute at runtime.
  • Supported operations: GET, POST, PATCH, DELETE. Write operations are restricted to administrators.
  • For path-and-key vault types (AWS Secrets Manager, HashiCorp Vault, Keeper Vault), vaultPath and vaultKey are required. For path-only types (Azure Key Vault, CyberArk), only vaultPath is required.
• System Center Virtual Machine Manager (SCVMM) Day-2 Actions CMP-3876
  • Snapshots: Create, Revert, and Delete server actions now work end-to-end against SCVMM checkpoints.
  • Change Resources: The SA Change Resources server action now supports SCVMM, updating CPU count and memory together in a single call.
  • Disks: The Disks tab is now visible for SCVMM servers and is populated from live SCVMM data, with full support for Add Disk, Extend Disk, and Remove Disk actions.
  • Networks: The Networks tab is now visible for SCVMM servers, showing per-NIC details such as MAC address, IP address, VLAN, and VM network.
  • Ad-Hoc Scripts: SCVMM servers can now run ad-hoc scripts — Linux guests use SSH; Windows guests use WinRM.

Enhancements

• MCP Server
  • New tools to set, view, and clear power schedules on resources and servers. CMP-3913
  • Support for catalog discovery and blueprint ordering: MCP clients can browse the catalog, inspect blueprint parameters and dynamic options, identify which groups a user can order a blueprint under, and submit orders. CMP-3897
• Flow Control
  • A new Manage Flow Control Filters permission allows Flow Control Operators to edit the filter fields of a Flow Control Action directly from the Flow Control Management page without requiring administrator access. CMP-4012
  • Flow Control Action group filters now support an Include Children option, which, when enabled, automatically applies the Flow Control Action to a selected parent group’s nested child groups. CMP-4011
• AWS resource handler API GET and LIST operations now return vault role mappings. CMP-3589
• KubeVirt-based resource handlers now support template namespace overrides, allowing a non-default namespace to be specified when selecting VM templates. CMP-3584
• Hyper-V resource handler now handles variations in storage path formatting and surfaces clearer diagnostic information when disk creation fails during VM provisioning. CMP-3922
• LDAP external user sync now correctly handles cases where a user no longer exists in LDAP, logging a clear failure message instead of encountering an error during group sync. CMP-3971

Bug fixes

• Fixed an issue causing the VMware Cloud Director resource handler to import subnets from unexpected organizations. CMP-3910
• Fixed an issue preventing non-administrator users from submitting orders for resource or server actions that use custom forms. CMP-4005
• Fixed an issue where the Hyper-V resource handler could encounter a race condition error when importing images or deploying VMs. CMP-3920
• Fixed an issue causing Nutanix VMs to be provisioned with Legacy BIOS mode instead of the configured UEFI or Secure Boot boot type. CMP-4008
• Fixed an issue where the Source Code Repository contents tab failed to display all linked Continuous Integration Tests and UI Extensions. CMP-3898
• Fixed an issue where logging out returned an error when an SSO provider had single logout enabled but its IdP metadata file was missing. CMP-4015

Release 2026.2.29

Availability: 22 May 2026

New features

Blueprints as Code now uses a cleaner, more reliable repository layout when syncing blueprints to source control. CMP-3535

• Blueprints are stored using a unique identifier rather than their display name, so renaming a blueprint no longer causes file moves or conflicts in git history.
• Shared plugin code is stored once in the repository rather than being copied into each blueprint, ensuring a single source of truth.
• During imports and syncs, existing components are updated in place to preserve continuity and reduce the risk of data loss.
• Nested blueprints also benefit from the flattened structure when refreshed from a remote source.
• These changes are fully backward compatible with existing blueprints stored in the legacy format.

Enhancements

• Improved Repository Import for Actions and Blueprints CMP-3886
  • Creating actions and blueprints from a source code repository no longer requires manually typing a file path. After selecting a repository and branch, CloudBolt automatically discovers available metadata files and presents them by friendly name in a dropdown. Refreshing a blueprint from a repository now presents the same selectors, allowing you to change the source branch before pulling.
• Hyper-V Resource Handler — SSH Key Support CMP-3875
  • During VM creation on a Linux server, Hyper-V now supports hostname verification using SSH keys instead of requiring username and password credentials.
• Hyper-V Resource Handler — Cluster Nodes Management CMP-3868
  • A new Cluster Nodes tab is now available on the Environments page for clustered Hyper-V configurations. You can view, edit, resync, and delete individual cluster nodes directly from the UI.

Bug fixes

• OpenShift Virtualization Resource Handler — Unnecessary VM Restart: Fixed an issue where VMs were unnecessarily restarted when only the CPU socket configuration changed via the Change Resources action. CMP-3709
• OpenShift Virtualization Resource Handler — Disk Access Mode: Fixed an issue where the selected disk access mode (ReadWriteOnce, ReadWriteMany, or ReadOnlyMany) was not applied when adding a disk to an OpenShift server. CMP-3790
• OpenShift Virtualization Resource Handler — Disk Size Display: Fixed an issue where displayed disk sizes for OpenShift Virtualization VMs did not account for filesystem overhead, resulting in inaccurate available space. CMP-3493
• Hyper-V Resource Handler — Missing Custom Fields: Fixed an issue where creating a clustered Hyper-V Resource Handler failed because dependent custom fields were not automatically created. CMP-3874
• Custom Forms — Per-Page Validation: Fixed a regression where Custom Form validation was deferred until order submission instead of validating each page as the user progresses. CMP-3752
• Inbound Webhooks — Performance Improvement: Fixed performance issues on the Inbound Web Hooks list page. CMP-3798
• Action Editor — Edit Button Error: Fixed an intermittent error when pressing Edit in the action editor, caused by a string handling issue. CMP-3772
• Server Decommission API: Fixed the server decommission endpoint. CMP-3888

Release 2026.2.16

Availability: 8 May 2026

New features

• CloudBolt MCP Server: Introducing support for Model Context Protocol (MCP), an open standard that enables AI assistants to interact with CMP using natural language. Users can list servers, check resource status, run power actions, and more, scoped to existing CMP permissions. CMP-3532
  • Supported AI clients include Claude, OpenCode, Cursor, and Visual Studio Code.
  • Authentication uses OAuth 2.0 with Dynamic Client Registration, so no manual OAuth setup is required for supported clients.
  • For setup instructions and available tools, refer to the MCP server integration guide.

Bug fixes

• Fixed multiple issues causing errors when managing Oracle Cloud Infrastructure servers:
  • Issue preventing OCI freeform tag values from saving when a tag allowed multiple selections.
  • Issue preventing the server details page from loading for servers with Server Lock settings configured.
  • Issue where the Sync VMs job could fail when encountering OCI instances in the Terminated state that had not yet been fully cleaned up. This error condition is logged in the job output, the affected server is skipped, and the sync job will continue. CMP-3566
• Fixed a network line-of-sight issue when consoling to Oracle Linux Virtualization Manager servers — console requests are now proxied through the CMP appliance; browsers need line-of-sight to CMP only. CMP-3753

Release 2026.2.10

Availability: 24 April 2026

Enhancements

• Django and Python upgrade.
• OpenShift Virtualization resource handler now supports soft reboot for virtual machines. CMP-3661
  • VMs can be gracefully rebooted via the guest OS using the SOFTREBOOT power action.

Bug fixes

• Fixed an issue allowing bypass of permissions on the Resource Actions Run Action API endpoint when attempting to target multiple resources. CMP-3619
• Fixed a path-traversal vulnerability in ZIP file processing where uploaded file paths were not validated against the root directory. CWE-22