Retool now blocks Microsoft SQL Server resources that use Windows Authentication with custom ODBC connection parameters outside an approved allowlist. Previously, unsupported parameters were logged as warnings but still applied. They now cause resource setup to fail.

Who is affected​

Self-hosted deployments using Microsoft SQL Server resources with Connect using Windows Auth enabled and one or more custom entries in Connection options (or equivalent resource JSON) whose keys are not on the allowlist. Windows Authentication is not available on Retool Cloud.

How to check if you are affected before upgrading​

Search your Retool deployment logs (dbconnector / backend) for this exact string from the prior log-only release:

MSSQL Windows Auth ODBC connection string parameter not on allowlist

Each matching log line includes the parameter key (parameterKey in structured logs). Resources that logged this message will fail to connect or save after upgrading until those parameters are removed or replaced.

What you will see after upgrading​

Resource setup or test connection fails with an error like:

Unsupported MSSQL ODBC connection string parameter "<key>". Only a fixed set of ODBC attributes may be supplied via connection params.

Remediation​

1. Open each affected MSSQL Windows Auth resource.
2. Remove unsupported keys from paramsFromConnectionString.
3. Use Retool's built-in resource fields where possible. For example, use SSL/TLS for encryption and certificate verification.
4. If you need an ODBC attribute that is not listed below, contact Retool Support before upgrading.

Allowed paramsFromConnectionString keys​

Security-sensitive attributes (Driver, Encrypt, Trusted_Connection, credentials, Server, Database, and similar) are set by Retool and cannot be supplied via connection params.

Common parameters that are blocked​

• Encryption and certificate trust settings such as Encrypt and TrustServerCertificate — use the resource SSL/TLS settings instead.
• LoginRetryCount / LoginRetryInterval — use ConnectRetryCount / ConnectRetryInterval.
• Credential keys such as Uid, Pwd, User, or Password.
• Keys containing ; or crafted to inject additional ODBC attributes.

Admins can now customize the Content Security Policy (CSP) that Retool enforces on apps. Retool applies a strict default policy that restricts which origins an app can load scripts, fonts, images, and other resources from. You can now extend that policy org-wide to allow the additional origins your apps need, or tighten the defaults further.

For example, if custom JavaScript in an app loads a charting library from a CDN such as https://cdn.example.com, the default script-src 'self' policy blocks the script and the app fails to render it. You can now add that origin to script-src so the app can load it without loosening the policy for any other resource.

Configure rules in Settings > App security > Content Security Policy. Changes apply to every app in your organization and are recorded in your audit logs.

For more information, refer to Customize the Content Security Policy for apps.

Customers with a 3.259.0-edge deployment should immediately update to 3.259.1-edge. This patch release addresses a security vulnerability that could expose environment variables during code-executor startup.

Self-hosted Retool 3.251 and later contain two notable changes to the code-executor service:

• A container running code-executor is required to run workflows and custom API authentication. Previously, these features could be run in a sandbox in the backend container. Retool's security team has become aware of a sandbox escape and will no longer be supporting sandboxing in the backend. For more information refer to the disclosure page.
• Traffic to the private 192.168.0.0/16 IP address range is blocked by default. If you want to disable this security configuration, follow the instructions in the code-executor security privileges documentation.

Due to potential security concerns, Retool is removing certain functionality that enables external app users to download images. No security breach or active vulnerability has occurred, and you do not need to take any security-specific actions.

External and embedded, publicly available apps will no longer support:

• Download Image columns in the Legacy Table component. Use an alternative method, such as a Link or Button column type, for image URL links. Retool strongly recommends you migrate to the current Table component instead.
• Export PDFs with images hosted on separate domains. All other components will be included in the PDF export. Retool recommends moving your publicly-hosted images to be hosted on the same domain as your Retool instance. For example, you could use images that are natively uploaded to the Image component, stored in Retool Storage, stored in Retool Database, Base64-encoded, or stored in an Amazon S3 bucket.

Retool is dedicated to protecting the confidentiality, integrity, and availability of our platform. The new vulnerability disclosure program enables you to submit reports of any potential security concerns that you may have.

You can now use FIDO2-compliant hardware security keys, such as the YubiKey 5, with two-factor authentication.