Changelog

Summary​

• Several of eMudhra's emSign intermediate certificate authorities were compromised and revoked upstream. Components bundled in Retool trusted certificates signed by those intermediates.
• This created a man-in-the-middle risk for self-hosted instances on affected versions: an attacker would need both a certificate from the compromised intermediates and a network position between your instance and an external endpoint.
• Cloud was patched centrally. Self-hosted customers should upgrade.
• IOCs: None. No exploitation observed, and no indication any maliciously signed package was pulled in.
• Maintained stable releases contain a full fix (v4.0 and newer), version 3.334 received a partial fix for the Node, Python, and PIP systems, Java was not patched due to no upstream patch available.

The following patches are now available on the Stable release channel:

• Retool 3.334.32

Update your Retool instance to apply the latest bug fixes and security patches.

Retool 4.81 is now available on the Edge release channel for self-hosted organizations.

A vulnerability in Node.js, the runtime that Retool runs on, can allow remote code execution. An out-of-bounds write in the Node.js Brotli decoder can be triggered by a crafted, Brotli-compressed HTTP response. Many of the HTTP clients that Retool uses decompress Brotli responses automatically. An attacker who can make a Retool instance send an HTTP request to a server they control, such as through a REST API resource, could use this to run code on that instance.

The following patches are now available on the Stable release channel:

• Retool 4.34.12
• Retool 4.0.25

Update your Retool instance to apply the latest bug fixes and security patches.

The following patches are now available on the Stable release channel:

• Retool 4.34.10
• Retool 4.0.23

Update your Retool instance to apply the latest bug fixes and security patches.

Retool 4.78 is now available on the Edge release channel for self-hosted organizations.

Summary​

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is an upstream PHP vulnerability.
• Retool is not affected. PHP does not run on anything internet-facing, nor does it run in our production environments.
• No action required.

Gemini 4 Argon is now available in Retool through Google and Google Vertex AI. It is available to Enterprise organizations that bring their own key.

Use Gemini 4 Argon with AI resource queries and building apps.

Enterprise organizations can now implement multi-instance releases for apps using any supported SCM provider: AWS CodeCommit, Azure Repos, BitBucket, GitHub, and GitLab.

To enable multi-instance releases, navigate to Settings > Source control > Edit settings and turn on Enable multi-instance releases.

This feature enables you to publish different release versions across instances, making it possible to test a newer version on staging or development instances before promoting to production. Get started with multi-instance releases for apps.