June 2026 Monthly Release
For help upgrading to the latest version, contact your Cloudhouse Representative. The following table describes each component available to upgrade within this release of Cloudhouse Guardian (Guardian).
Tip: For more information on the known issues currently present within Guardian, see Known Issues.
| Release Date | Guardian Platform | Guardian Web | Guardian Agent |
|---|---|---|---|
| 14th July 2026 | V4.3671.0 | V3.67.1 | V5.52.0 |
Guardian Platform V4.3671.0
Here's what's included in V4.3671.0 of the Guardian Platform as part of the June 2026 monthly release.
Other Enhancements
The following additional enhancements are included within this release of the Guardian Platform.
SFTP File Delivery Endpoint
Customers who deliver files to Cloudhouse over SFTP can now connect through a fixed, advertised IP address they can allowlist at their firewall. Uploaded files are written directly to the customer's designated S3 bucket path, with each customer isolated to their own prefix.
Ingress Consolidated onto Istio
With all appliance ingress now handled by the Istio service mesh, the orphaned ingress-nginx controller and the unused reverse-proxy uploader have been removed, reducing the appliance's footprint and vulnerability surface. The nginx file server and NFS server are unaffected.
Reduced Syslog Footprint
The syslog container is now deployed only when a syslog destination is configured, so it no longer consumes appliance resources when it isn't in use.
Appliance Operating System & Kubernetes Updates
The Guardian appliance base operating system and Kubernetes components have been updated to their current patch versions.
PostgreSQL Update
The bundled PostgreSQL database has been updated to 14.23.1.
Security Updates
Vulnerabilities have been reviewed and remediated across Guardian Platform components, including Fimdozer, the Syslog Forwarder, Hannah, Flannel, Flatcar, ConfigTTY, the scheduled-jobs runner, and Istio.
Fixed Issues
The following issue has been fixed within this release of the Guardian Platform.
| GP-429 – Airgapped Mandatory Upgrade Could Deadlock During a Kubernetes Minor Upgrade | |
|---|---|
| Affects Versions: V4.3642.0 and later | Fix Version: V4.3670.0 |
| Problem: |
On an airgapped appliance, a mandatory upgrade that crossed a Kubernetes minor version (for example 1.33 to 1.34) could deadlock after the post-upgrade reboot. The outgoing kube-proxy image was removed during installation while the cluster still referenced it, so kube-proxy could not start, cluster networking went down, and the upgrade service repeatedly restarted without ever completing. |
| Solution: |
Mandatory upgrades now complete across minor Kubernetes versions on airgapped appliances — kube-proxy is updated correctly and the appliance converges. |
Guardian Web Application V3.67.1
Here's what's included in V3.67.1 of the Guardian web application as part of the June 2026 monthly release.
Other Enhancements
The following additional enhancements are included within this release of the Guardian web application.
View and Promote Detected Nodes
The All Nodes page now includes a working Detected tab that lists automatically detected AWS nodes. You can review these nodes and promote them to Monitored — or mark them as unmanaged — individually or in bulk.
Universal Search
The universal search bar now returns results across the product.
Faster Change Reports
Approving changes no longer triggers a full reload of the change report.
Policy Editing Improvements
A set of usability improvements to the policy editing experience.
AWS Operating-System Family in Accelerator
The AWS operating-system family is now surfaced to Accelerator for classification.
Security Updates
Puma has been upgraded to address CVE-2026-47736 and CVE-2026-47737, and further vulnerabilities across Secure have been remediated.
Fixed Issues
The following issues have been fixed within this release of the Guardian web application.
| GWB-6231 – Rule-Based Node Groups Could Be Edited Manually | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
Node groups that determine their membership from node rules still offered "Add Node to Group" and "Remove from Group". Manual changes appeared to work but were silently reverted the next time the rules ran, which was confusing. |
| Solution: |
For rule-based groups the manual add and remove controls are now hidden or disabled (as they already are for dynamic groups), and membership is managed entirely by the rules. Nodes previously added by hand are left unchanged. |
| GWB-6361 – Filtering a Change Report by a Deleted Approval Reason Did Nothing | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
In the change report, clicking the badge for an approval reason that had since been deleted did nothing — the report was not filtered and the sidebar filter field was not populated. |
| Solution: |
Clicking a deleted reason's badge now filters the report to the changes carrying that reason and shows the reason in the active filter. Active reasons continue to work as before. |
| GWB-6551 – "Remember Me" Did Not Keep Users Signed In | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
The "Remember me" option — available when LDAP authentication is enabled — did not keep users signed in. |
| Solution: |
"Remember me" now keeps the session active when selected. |
| GWB-6616 – Settings Page Could Raise an RSA Key Error | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
The settings page could raise an OpenSSL RSA key error ("Neither PUB key nor PRIV key") when no RSA key was configured. |
| Solution: |
The settings page now handles a missing or misconfigured RSA key without erroring. |
| GWB-6622 – Airgapped Appliances Attempted an Internet Image Pull for Scheduled Jobs | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
The curl-job-runner image was missing from the appliance images list, so the platform fell back to pulling the latest image from the internet. On airgapped appliances the pull failed and scheduled jobs stopped running. |
| Solution: |
The curl-job-runner image is now included in the images list at a pinned version, so no internet pull is attempted and scheduled jobs continue to run. |
| GWB-6645 – Viewing Large Node Files Could Freeze the Browser | |
|---|---|
| Affects Versions: – | Fix Version: V3.67.0 |
| Problem: |
Opening a very large node file (for example a ~50 MB configuration) in the file viewer would appear to load but then lock up the browser tab — scrolling, downloading, and other actions failed until the tab errored. |
| Solution: |
Very large files are no longer rendered inline; a download link is offered instead, diffs use pre-computed blocks, and downloads are streamed rather than held in memory. Large node files no longer freeze the tab. |
Guardian Agent V5.52.0
Here's what's included in V5.52.0 of the Guardian Agent as part of the June 2026 monthly release.
Other Enhancements
The following additional enhancements are included within this release of the Guardian Agent.
Security Updates
The Go toolchain and agent dependencies have been updated to remediate vulnerabilities in the agent.