# Release 2026.3 > New features, enhancements, and bug fixes in CMP Release 2026.3 --- Site [llms.txt](/llms.txt) --- ## Latest release 2026.3.104 {#release-2026-3-104} Availability: 21 Oct 2026 ### Enhancements {#enhancements-2026-3-104} - **[Custom forms](/docs/cmp/configure/order-forms-and-pricing/custom-forms/#cmp-managed-fields)** now show the **Rate** and **Cost Preview** when ordering a blueprint and when editing an order. They follow the **Show "Rates" when ordering** and **Show "Cost Preview" on Order forms** settings. (CMP-4378) ### Bug fixes {#bug-fixes-2026-3-104} - Fixed an issue introduced in [2026.3.101](#release-2026-3-101) where selecting **Save** in the parameter options dialog did not save the options or close the dialog. (CMP-4543) ## Release 2026.3.101 {#release-2026-3-101} Availability: 20 Oct 2026 ### Enhancements {#enhancements-2026-3-101} - **AWS** now discovers Dedicated Host Groups shared with the account through AWS Resource Access Manager, so you can import them into the **[Dedicated Host Group](/docs/cmp/configure/infrastructure/resource-handlers/aws/#provision-to-ec2-dedicated-hosts)** parameter and provision to them. This requires the `ram:ListResources` and `resource-groups:GetGroupConfiguration` permissions. (CMP-4457) ### Bug fixes {#bug-fixes-2026-3-101} - Fixed table issues introduced in [2026.3.97](#release-2026-3-97), including: selecting servers and selecting **Actions** did not open a dialog; dialogs submitted only the selected rows on the current page; selections were lost after paging; and search, sort order, and filters were shared between tables on the same page. (CMP-4543) - Fixed an issue where an order stayed **Active** with no jobs and no explanation when a Post-Order Approval action raised an error. The order now fails, and its history shows the error. (CMP-4406) - Fixed an issue where, when editing an order placed through a custom form, a dropdown that depends on another field kept its old value or went blank when that field changed. The dropdown now applies its initial value, as it does on a new order. (CMP-4091) - Fixed an issue where [blueprint exports](/docs/cmp/use/blueprints/share-and-control-access/export-and-upload/) did not include global parameter constraints (minimum, maximum, slider increment, and regex). They are now exported and applied on upload to parameters the upload creates, or to existing parameters when **Replace Existing** is selected. (CMP-4407) ## Release 2026.3.97 {#release-2026-3-97} Availability: 16 Oct 2026 ### New features {#new-features-2026-3-97} - **[User theme and navigation preferences](/docs/cmp/configure/administration/system/theme-configurations/)** (CMP-4482) - [Branded portals](/docs/cmp/configure/administration/system/branded-portals/) can now have an **Alternate Theme** in the opposite mode to the **Default Theme**. Users can then switch between light and dark mode with the **Dark Mode** toggle in the user menu. The choice is saved to their account. - Users can also choose **Left** or **Top** navigation on their user profile. - On upgrade, the out-of-the-box **CloudBolt** portal gets CloudBolt Dark as its Alternate Theme. Other portals are unchanged. - **Column filters on list pages** (CMP-3240) - Column headers now have a menu to sort and filter the column by a list of values, text, number, or date. Active filters show as chips above the table. Remove them one at a time or with **Clear all**. - Available on Servers, Resources, All Resources, Groups, Jobs, Recurring Jobs, Orders, and the action lists. ### Enhancements {#enhancements-2026-3-97} - **HTTPS** now uses HTTP/2 by default. Installing or upgrading CMP enables HTTP/2 on the default HTTPS site in `/etc/httpd/conf.d/ssl.conf`. If that file already sets `Protocols`, it is left unchanged. (CMP-4515) - **Hyper-V** now encodes the administrator password in the default sysprep template instead of storing it as plain text. (CMP-4238) - **VMware** now honors the **[Use Tech-Specific Script Execution](/docs/cmp/use/orchestration/remote-scripts/configure-method/)** parameter when extending the Windows root disk during provisioning. When it is off, CMP extends the disk over WinRM instead of VMware Tools. (CMP-4380) ### Bug fixes {#bug-fixes-2026-3-97} - Fixed a cross-site scripting (XSS) vulnerability in the Content Library import dialogs. (CMP-4514) - Fixed an information disclosure issue where error messages in the web interface included the server's Python traceback. The traceback is now written only to `/var/log/cloudbolt/application.log`. (CMP-4516) - Fixed a security issue where a bookmark could link to a site outside CMP. Bookmarks now accept only CMP pages, and an existing bookmark to another site no longer opens. (CMP-4517) - Fixed an issue where a misconfigured SSO provider caused the login page to fail with a server error. With **Automatically Login to SSO** on, this could lock everyone out. Users now see a message on the login form to log in with a local account. (CMP-4503) - Fixed an issue where non-admin SSO users got stuck in a login loop when **Automatically Login to SSO** and admin-only mode were both on. They now see a message that only admins can log in during admin-only mode. (CMP-4391) - Fixed an issue where users returned to the login page after a successful SAML SSO login when `SESSION_COOKIE_SAMESITE` was set to `'Strict'`. (CMP-3367) - Fixed an issue where the **Privacy Policy** and **Terms of Use** links did not appear on the centered login page. (CMP-4464) - Fixed an issue where AWS provisioning could hang in regions other than us-east-1 because CMP checked the instance status in the wrong region. (CMP-4230) - Fixed an issue where importing AWS instance types skipped some types in regions with more than 1000 instance type offerings. (CMP-4465) - Fixed an issue where importing networks from Infoblox failed with "Result set too large" when there were more than 5000 networks. (CMP-4411) - Fixed an issue where a Hyper-V network with the same name as a network on another Hyper-V resource handler was shared between the two handlers instead of being created separately. Networks added to a Hyper-V resource handler are now named with the handler's name in parentheses, such as "External (HV-Host2)". Existing networks are not renamed. (CMP-4483) - Fixed an issue where orchestration actions at the Pre-Delete and Post-Delete trigger points for Delete Server ignored the plugin's Blueprint filter and ran for all servers. If an action should run for every deleted server, remove its Blueprint filter. (CMP-4385) - Fixed an issue where each plugin run left a compiled file in `/run/cloudbolt/tmp/__pycache__`, which could fill `/run` on appliances that are rarely rebooted and cause jobs to fail. Existing files are removed when you upgrade. (CMP-4462) - Fixed an issue where UI Extension labels were lost when an extension was exported or imported. Labels can now also be edited on an installed extension. (CMP-4088) - Fixed layout issues on the **Recurring Job** details page, where action inputs showed several edit buttons and were misaligned. (CMP-4475) ## Release 2026.3.78 {#release-2026-3-78} Availability: 25 Sep 2026 ### New features {#new-features-2026-3-78} - **[HashiCorp Vault namespace support](/docs/cmp/configure/access-and-security/security/use-password-vaults/)** (CMP-4079) - The HashiCorp Vault integration now supports Vault Enterprise namespaces. A new **Vault Namespace** field is available when creating or editing a Vault connection for Token and AppRole authentication. - Leave the field blank to use the root namespace. Existing connections are unaffected. - To use secrets from more than one namespace on the same Vault server, configure a Vault connection for each, with credentials valid in that namespace. ### Enhancements {#enhancements-2026-3-78} - **[Resource Types](/docs/cmp/use/resources/resource-types/)** now support a description and categories. A description explains what the Resource Type is for, with free-form category labels to group Resource Types. Both can be set when creating or editing a Resource Type, and can be read and written through the `/api/v3/cmp/resourceTypes/` API. (CMP-4383) - **Resource Types** are now visible to non-administrators, who can also run **Sync Resources** for a specific Resource Type. (CMP-3215) - **Order details:** the **Save to Catalog** button has been removed. It created a new blueprint duplicating the one used to place the order, adding no value. (CMP-3403) - **VMware** now describes the **Cores per Socket** parameter on the resource modification form, explaining how vCPUs map to sockets. (CMP-4184) - **Hyper-V** now honors the **[VM Customization Timeout](/docs/cmp/use/servers/customize-vms/)** parameter, allowing you to set how long CMP waits for a VM to report its IP address and hostname. (CMP-4281) - **H3C CAS** now supports VM snapshots and console access. Create, revert to, and delete snapshots from a server's page, and open a VM console with the **Console** button. (CMP-4107, CMP-4109) - **[OpenShift Virtualization](/docs/cmp/configure/infrastructure/resource-handlers/openshift-virtualization/)** now imports custom templates created in your cluster alongside the built-in templates, so they appear in the Import Templates list and can be ordered from the catalog. Ordering the same custom template more than once no longer conflicts with an earlier deployment, and a template declaring parameters CMP cannot supply reports those that require a default value before ordering. (CMP-4377) - **Dates and times** in the CMP interface now display in your browser's locale. (CMP-3421) - **Action lists** can now be sorted by **Name** on Server Actions, Resource Actions, Inbound Web Hooks, Flow Control Actions, and MCP Tool Actions. The Inbound Web Hooks search box also matches on Global ID. (CMP-4074) - **[MCP clients](/docs/cmp/developer-resources/mcp/custom-tools/)** now receive action input descriptions and placeholders, so an AI agent has guidance from a CMP administrator to help choose a value. (CMP-4453) - **OAuth:** the MCP endpoint's 401 challenge now lists accepted scopes, and authorization responses carry the RFC 9207 `iss` parameter, so clients can confirm where a response originated. No configuration is required. (CMP-4310) ### Bug fixes {#bug-fixes-2026-3-78} - Fixed an issue where a custom form offered networks that did not belong to the selected group and environment when choosing a network for a NIC. (CMP-4160) - Fixed an issue where Dashboard widgets could overlap after being moved, resized, or expanded, and the overlap could persist after reloading the page. (CMP-4423, CMP-4424) - Fixed an issue where the **Cancel order** button on paused Flow Control orders was shown to administrators who could not cancel the order and hidden from the order owner who could. (CMP-4419) - Fixed an issue where a quantity entered as a blueprint parameter was applied twice to server tiers: an order of 2 resulted in 4 servers instead of 2 deployments of one server each. (CMP-3954) - Fixed an issue where an Environment Selection Orchestration hook that returned only an environment caused the deployment to fail. A quantity returned by a hook is now applied correctly. (CMP-3954) - Fixed an issue where MCP clients reported a connection error when opening the optional server-to-client event stream. CMP now returns Method Not Allowed, which clients recognize and skip. (CMP-4292) - Fixed an issue on the **Order Details** page where the **Show all messages** panel collapsed while a job was running, and a job's elapsed time could become illegible on Order Details and Job Details pages. (CMP-4381) - Fixed an issue in multi-worker deployments where two Job Engine workers could claim and run the same job. Resource handler sync jobs reported a false failure, and other job types ran twice without visible errors. (CMP-4461) - Fixed an issue where importing or refreshing a Blueprint with a custom form could run a parameter's Generated Parameter Options method instead of skipping it. `GET /api/v3/cmp/blueprints/{id}/deploymentSchema/` now skips them as well, which can change the `listOfValues` and `hasGeneratedOptionsSupport` values returned for those parameters. (CMP-4388) - Fixed an issue where the **Refresh Blueprints from Remote Source** recurring job could fail unexpectedly. The refresh now falls back to the credentials configured on the Source Code Repository when no user profile is available. (CMP-4183) - Fixed an issue where refreshing Blueprints from a Source Code Repository stopped the entire batch if one Blueprint's file was missing from the repository. That Blueprint is now reported as failed, and the rest are still processed. (CMP-4389) - Fixed an issue where the [MCP server](/docs/cmp/developer-resources/mcp/custom-tools/) ignored the **Allow Bulk Operation** setting on Server Actions, letting an action meant for a single server run against several. Parameters supplied over MCP are now validated before the action runs. (CMP-4452) - Fixed an issue where a custom banner image on a Branded Portal was being cut off behind the top navigation bar after an upgrade. The banner now displays in full below the navigation bar, and the security message no longer sits behind it. (CMP-4454) - Fixed an issue where vCloud Director discovery returned only the first 25 records, truncating organizations, VDCs, networks, servers, templates, and catalogs. Network synchronization no longer removes CMP network records for organization networks that still exist in vCloud Director. (CMP-4394, CMP-4399) ## Release 2026.3.55 {#release-2026-3-55} Availability: 3 Sep 2026 ### Bug fixes {#bug-fixes-2026-3-55} - Fixed an issue where validating a Resource Action's custom form could fail with a server error. (CMP-4241) - Fixed an issue where a validation error on the **Password** field of a Connection Info form was not displayed, making **Save** appear to do nothing. (CMP-4387) - Fixed an issue where opening a Server Action or Resource Action link in a new tab displayed raw JSON instead of the CMP interface. The right-click menu is now disabled for these links. (CMP-4343) - Fixed an issue where a custom form parameter with generated options displayed incorrect options or failed to load them when a pending order was edited. Options are now generated for the user editing the order. (CMP-4089) - Fixed several layout issues on the order form: the loading overlay extended beyond the order container, the service item navigation was misplaced when editing or duplicating an order, and the notification area could block selects the menu bar. (CMP-4376) ## Release 2026.3.51 {#release-2026-3-51} Availability: 28 Aug 2026 ### New features {#new-features-2026-3-51} - **[Redesigned interface and guided onboarding](/docs/cmp/get-started/complete-initial-setup/)** (CMP-3238, CMP-3878) - A refreshed interface modernizes navigation and everyday workflows across the platform. - The interface now runs on Bootstrap 5, with no Bootstrap 3 compatibility layer. Custom templates, UI extensions, and JavaScript written for Bootstrap 3 may need changes. See [Upgrading to Release 2026.3: Bootstrap 5 migration for UI extensions](/docs/cmp/configure/administration/maintain/upgrade/release-2026-3/). - On first launch, a new configuration page walks you through creating your administrator account and choosing a license. - After you log in, the **Setup Wizard** guides you through adding infrastructure and content so you can start provisioning immediately. - The refreshed **[Dashboard](/docs/cmp/get-started/dashboard/)** is customizable: show or hide widgets, rearrange and resize them, and save your layout or restore the default. Administrators can also save the current layout as the default for administrators or for non-administrators. (CMP-4235, CMP-4356) - **[Light and dark themes](/docs/cmp/configure/administration/system/theme-configurations/)** (CMP-4277) - CMP now ships two built-in, customizable themes: **CloudBolt Light** and **CloudBolt Dark**. Go to **Admin** > **Theme Configuration** to configure and add themes, and **Admin** > **Branded Portals** to set one for a portal. - The theme previously named **CloudBolt Default** is now **CloudBolt Light**. Existing portals automatically follow the rename and retain their current appearance. - **[Free tier license](/docs/cmp/configure/administration/product-license/)** (CMP-3961) - CMP now ships with a built-in free trial license, giving you the full feature set for up to 100 resources, valid for up to one year. - The trial license is applied automatically on a fresh installation. Upgrades to an existing appliance are unaffected and keep their current license. - **API token expiration notifications** (CMP-4090) - A new recurring job, **Notify Users of Expiring API Tokens**, emails users before their API authentication token expires. The job is disabled by default; enable it under **Admin** > **Recurring Jobs**. - The user profile page now shows the token's expiration date and the number of days remaining, with a flag when the token is nearing expiration or has expired. ### Enhancements {#enhancements-2026-3-51} - **Recurring jobs** now offer a scheduling widget on the **Schedule** field, so you no longer have to write a cron expression by hand. (CMP-4237) - **MCP server** now reliably loads tools for non-administrators and offers them Server Actions and Resource Actions that an administrator has promoted as tools. (CMP-4306) - **Power schedules** can now be set on the catalog order form using a drag-to-paint weekly grid, with Paint and Erase modes and one-click presets for Weekdays 9–5, Every day 9–5, and Clear. (CMP-4261) - **Branded portals:** the login splash panel now inherits the theme's **Page Background** color, ensuring consistent portal branding. The **Splash Background Color** field has been removed. (CMP-4267) ### Bug fixes {#bug-fixes-2026-3-51} - Fixed an issue where a custom form's stylesheet was not applied when editing an order. (CMP-4185) - Fixed an issue where server statistics failed to load for GCP servers because timestamps sent to Google Cloud Monitoring omitted a timezone offset. (CMP-4093) - Fixed an issue where the **Time Zone** selection on a scheduling dialog was reset to the browser's time zone when the dialog was redisplayed after a validation error. (CMP-4345) - Fixed an issue where the **Upgrade Content from Library** recurring job reinstalled the Self-Service Portal nightly after an administrator removed it. The job has been removed. (CMP-4357) - Fixed an issue where a generated custom form omitted the **Static IP Address** field when the network was configured for static IP addressing without an IP pool, causing provisioning to fall back to DHCP and the job to fail. (CMP-2905) - Fixed an issue where running a Resource Action through the MCP server did not check that the requesting user was permitted. The permission check is now enforced, and Resource Action discovery through MCP is scoped to a user's actions. (CMP-4307) - Fixed an issue where leaving **Default Redirect** blank in Miscellaneous Settings caused an error on the password reset confirmation page and caused the Legal Notice page to reload instead of continuing. Both now fall back to `/dashboard/`. (CMP-4318)