Skip to main content
Version: Developer

What's new in Kasm 1.19.0

warning

Memory and storage configuration fields in the Admin API now use byte-based parameters (for example standby_memory_bytes, aws_ec2_ebs_volume_size_bytes, vsphere_memory_bytes). Legacy *_mb, *_gb, and vsphere_memoryMB fields have been removed. Update automation and integrations before upgrading.

Highlights​

  • Added configurable password complexity settings for local accounts, allowing admins to set minimum length and character requirements. Includes a Force Password Reset toggle to enforce new rules on existing users.
  • Added the ability to disable file mappings without having to delete them.
  • Added support for h.264, h.265, and AV1 video streaming modes to KasmVNC for container based Workspaces.
  • Standardized memory and storage configuration across the admin console and APIs. Input fields now provide unit selectors (Bytes/MiB/GiB for memory, Bytes/GB or Bytes/GiB for storage) while Kasm persists the values as bytes for consistent autoscale and provider provisioning logic.
  • Installation will now default to using rolling images. Refer to Rolling Image Management.
  • Updated Apache Guacamole to version 1.6.0. This release includes significant improvements:
    • Frame Encoding Pipeline Rewrite with multi-threaded encoding for improved performance.
    • Upgraded to FreeRDP 3.0 for improved RDP session handling
    • RDPGFX (Graphics Pipeline Extension) support via FreeRDP 3.0 GDI-backed rendering backend for enhanced graphics performance
    • Better handling of dynamic display resolution changes
    • Support for additional RDP keyboard layouts: Czech (cs-cz), French Canadian (fr-ca), Portuguese Brazil (pt-br), Portuguese Portugal (pt-pt), and Romanian (ro-ro)
    • The full changelog can be found at https://guacamole.apache.org/releases/1.6.0/
  • Added support for Intel and AMD GPU passthrough for graphics and video acceleration.
  • Added support for provisioning container workspaces on NVIDIA Multi-Instance GPU (MiG) slices, enabling high-end NVIDIA GPU hardware to be partitioned and shared across multiple simultaneous workspaces without requiring licensed vGPU drivers.
  • Added support for full stack Linux VMs delivered over RDP, enabling persistent, high-performance Linux desktop environments accessible directly through the Kasm Workspaces interface.
  • Added support for configuring server expiration, allowing servers in a pool to be automatically drained after a configurable period of time and rotated out by the autoscaling system.
  • Added support for direct RDP client authentication, allowing users to connect to Kasm Workspaces using their Kasm credentials from any standard RDP client without a browser. This feature is controlled by group and zone-level settings and is disabled by default.
  • Kasm Workspaces on Kubernetes has graduated to General Availability. The Kasm platform management plane is now natively integrated for Kubernetes deployments, removing the need for environment-specific workarounds previously required in the Helm chart.
  • Added new Workspace Images:
    • Fedora 42
    • Fedora 43
    • Alpine 3.22
    • Alpine 3.23
    • ParrotOS 7
    • OpenSUSE 16
  • Removed EOL Workspace Images.
  • Introduced the System Metrics page to help administrators monitor component health, identify affected services, and review detailed metric snapshots for faster troubleshooting.
  • Added support for ZTNA via OpenZiti.
  • Added a Support Bundle page to generate diagnostic packages that can be downloaded and shared for troubleshooting.

Features​

  • Usability Enhancements

    • Enhanced group permissions validation to support GROUPS_VIEW, GROUPS_VIEW_IFMEMBER and GROUPS_VIEW_SYSTEM permissions in the /api/admin/get_permissions_group API endpoint.
    • Added public API version for exec_kasm functionality.
    • Added option to disable a manager in the UI.
    • Server Pools, Servers, and AutoScale Configs admin UI tables now use server-side pagination for improved loading performance.
    • Added new group setting to prevent deletion of active anonymous sessions post-expiration.
    • Redesigned the system configuration export/import into four distinct export modes: Complete Data Set, Partial Data Set (with database table selection), Autoscale Configs, and Deployment Configuration (full deployment migration excluding runtime state, with options to preserve manager tokens and API key pairs).
    • Added a two-step import workflow with preview and configuration, including additive imports (now the default), zone/LDAP mapping for autoscale imports, and automatic conflict resolution with datetime-stamped renaming.
    • Added support for tokenizing UUIDs during system configuration export and import.
    • When launching a Workspace, the deployment zone dropdown now shows the latency of each zone, indicates which zone Auto will select, and remembers the user's last selection.
    • Admins can now view the details of deleted Server Enrollment Tokens in the admin UI.
    • Added a new --ignore-dep-failures flag to install.sh and upgrade.sh to continue past optional dependency (rclone, wireguard, v4l2loopback, fuse) install failures instead of aborting.
    • Added a new --enable-epel flag to install.sh and upgrade.sh to enable the EPEL repository, allowing WireGuard and other packages to be installed on RHEL/Rocky/AlmaLinux 8 systems.

  • Infrastructure Support Enhancements

    • Updated the Database container to use PostgreSQL 16.10.
    • Added support for Debian 13 (Trixie) installation.
    • Added a new autoscaling script for RPM-based Linux distributions (Oracle Linux and RHEL) and enhanced the existing Debian-based script to support the Kasm Desktop Service (KDS) Linux service.
    • The Kasm installation script now supports flags to provide existing SSL certificates at install time, eliminating the need to manually replace the self-signed certificate after installation.
    • Added support for additional Azure VM provider configuration fields — Plan, Security Type, Secure Boot, and vTPM — directly in the autoscale configuration UI, eliminating the need to specify these settings via the JSON config override.
    • Added a rolling installer tarball that always resolves to the latest patch build.
    • Added cloud-init/cloudbase-init support for VMware vSphere autoscaling, enabling startup script injection without requiring VMware Guest Operations credentials.
    • Added VM SSH Public Key configuration to VMware vSphere provider, available as {ssh_key} variable in startup scripts.
    • Added linked clone support for VMware vSphere autoscaling, allowing VMs to be provisioned from snapshots with reduced storage requirements and faster provisioning.
    • Updated default memory value from MB to MiB.
    • Migrated autoscale, workspace, and provider configuration schemas to byte-based fields (*_bytes) and backfilled existing data for reliable conversions and validation.

  • Kasm Desktop Service

    • Replaced PySimpleGUI with license-free FreeSimpleGUI version.
    • Replaced memory and storage inputs throughout the admin console with a storage selector that transparently converts between units and submits byte values to the API.

  • Developer API Enhancements

  • Kasm Image Enhancements

Bugfixes​

  • Security Fixes
  • Fixed Cast session limit being decremented when resuming existing sessions.
  • Applied a Guacamole change that improves error communication during user connection creation.
  • Fixed issue where volume mappings defined in a registry workspace couldn't be passed when installing the workspace.
  • Fixed issue of scripts and file mappings in Kasm Desktop Service windows for prompt user.
  • Fixed issue related to passing multiple smart card readers into Kasm Workspaces.
  • Fixed bug that prevented defining custom docker container labels via Docker Run Config Override.
  • Storage Mapping Based Profiles has been updated to significantly reduce disk space requirements, includes reliability fixes, and a recovery mode.
  • Fixed registry memory value not being passed to workspaces.
  • Fixed static table sorting issues.
  • Updated the minimum version requirement for Docker and Docker-compose.
  • Fixed an issue with previously stored values in the Egress provider form on user dashboard.
  • Added fix to ensure that a slow database log rotation or kasm update check on the manager does not result in the manager not responding to API requests.
  • Added logic to ensure that database log rotation and kasm update check does not run on multiple managers in multi-zone deployments.
  • Fixed issue where VSphere provider fails to delete instances if they are powered off.
  • Fixed issue of Server Sessions remaining stuck at deleting state by providing force delete option and implementing safe retry logic in manager.
  • Fixed issue with get_kasm_screenshot API where height parameter was mapped to width and vice versa.
  • Improved the log cleanup background job for more efficient processing using global settings. Debug Log Retention is now based on the number of logs instead of hours. Similarly, Local Log Retention is now based on the number of logs rather than days.
  • Fixed issue where some APIs returned incorrect 401 and 403 error codes.
  • Fixed some issues with file mapping, including toggles not working on file uploads, and stale data when editing a file map.
  • Fixed issue with webcam not recovering after being turned off and back on again without reloading.
  • Fixed issue with the microphone state getting out of sync with what it should be if toggled too quickly.
  • Fixed data syncing for Storage Mapping Based Profiles during deletion after pause and session stop.
  • Fixed issue with Storage Mapping Based Profiles not running on certain distros.
  • Fixed logout button missing in user profile on mobile devices.
  • Web manifest changed to use absolute URLs rather than relative ones as Chrome appeared to get lost occasionally.
  • Fixed upgrade script to block same-version upgrades, preventing database backup permission errors caused by leftover backup files from earlier runs.
  • Fixed a bug that prevented connection proxy token refresh when "API Token Refresh Leeway" was set to a very high value.
  • Fixed a bug that marked connection proxy tokens as consumed even when an error prevented token refresh.
  • Fixed issue with Kasm nginx only resolves upstream dns when it is reloaded.
  • Fixed issue with file write and executable option being available in file mapping for server session.
  • Fixed unhandled exception when disabling storage mappings.
  • Added warnings in kasmweb for features of Kasm Desktop Service - Linux, that are under planned for future release
  • Fixed issue with WebAuthn that would prevent large key devices from registering.
  • Fixed incorrect inline help entries for Network Name and Interface Type on the Harvester VM provider config.
  • Fixed zombie container cleanup issues on multi server deployments.
  • Fixed issue where clipboard-up content was truncated at 10 KB.
  • Fixed Guacamole seamless clipboard overwriting by handling clipboard streams correctly, and increased the maximum size of content that can be transferred via the clipboard.
  • Updated Guac container logging to use size based file rotation instead of time based rotation.
  • Fixed file permission issues with Nginx logs not rotating on standard deployments.
  • Fixed issue where the Proxmox provider would lose access to a VM that was migrated to another node.
  • Fixed issue where VM creation would fail on Harvester 1.7 due to missing limits spec.
  • Fixed an issue with Kasm multi-server installation of the web app using a PostgreSQL database.
  • Fixed deadlock exception during agent heartbeat caused by conflicting updates to server_image_slots.
  • Increased the timeout of STS tokens for S3 based Profile Sync to reduce chances of a large profile taking longer than the STS token is valid for.
  • Increased the default timeout for S3 persistent profile sync on session end.
  • Fixed issue where the RDP HTTPS Gateway would send keepalives for sessions it was not associated with.
  • Fixed PostgreSQL password parsing issues involving special characters and resolved file permission failures during remote database upgrades on systems with restrictive umask settings. Also addressed minor issues in the upgrade script.
  • Fixed issue with initialization script for the external DB connection.
  • Fixed issue where usernames were injected un-sanitized into LDAP queries allowing arbitrary lookups.
  • Fixed bug occurring during system configuration export/import, which caused the omission of User - Server associations, Egress Gateway - Egress Credential associations, and Egress Gateway - Egress Provider Mapping associations.
  • Fixed compatibility issue with Docker 29+ where removed iptables isolation chains caused network plugin failures.
  • Fixed issue running Guacamole with a cluster size of 1.
  • Fixed bug where webcams less than 720p would crash the UI when forwarded to a workspace.
  • Fixed issue where servers with utf8 credentials could cause workspace launch failures.
  • Added documentation note clarifying that User SSO is required for file and storage mappings on Windows and Linux VM sessions.
  • Added an optional wrapper for bwrap in Kali Rolling Desktop and Trace Labs images to prevent the black screen issue for high-privilege sessions. See the KB article for more info.
  • Fixed issue where ldap misconfiguration could lead to privilege escalation.
  • Improved session handling in guardian loop to prevent potential idle database session accumulation.
  • Fixed issue with reset persistent profile not working as NFS submounts were not propagated into the helper container.
  • Added retries for kasm_rdp_gateway and kasm_rdp_https_gateway configs in the healthcheck.
  • Fixed performance degradation when using the get_users public API with large user datasets.
  • Fixed Docker STIG hardening script overwriting the Kasm logging plugin configuration.
  • Improved the performance of RDP thick client sessions when Kasm DLP protections are enabled, addressing bitmap-based rendering bottlenecks that caused visible screen tearing at higher resolutions.
  • Fixed issue where Windows Desktop Service could not be registered when Kasm is deployed behind a path-based reverse proxy, due to a missing proxy prefix field in the registration form.
  • Fixed issue where mobile users with narrow screen resolutions could get stuck with no way to close the displays control panel widget after opening it.
  • Fixed issue where Windows autoscale startup scripts failed on the vSphere provider because the VM was not yet registered in the database when the script executed.
  • Fixed issue where the Kasm STIG hardening script failed on webapp role servers in multi-server deployments due to attempting to configure services not present on that role.
  • Fixed issue where UI-level logging was not captured for users authenticated via SSO.
  • Fixed issue where typing in the Workspace Registry search field caused a page crash across all registry sources.
  • Fixed regression where the web-native Guacamole client no longer prompted users for credentials when using blank static credentials or the "Prompt User" setting, causing connections to hang instead.
  • Fixed issue where container session logs were not captured when a session failed immediately at startup, making it difficult to diagnose launch failures.
  • Fixed issue where the Kasm upgrade script did not update the v4l2 kernel module to the latest version on existing installations.
  • Fixed issue where running Docker commands inside the Docker-in-Docker (dind and dind-rootless) workspace images failed with an overlay filesystem mount error.
  • Fixed issue where file uploads and downloads failed for web-native RDP sessions when the server was configured to use Prompt User credentials.
  • Fixed issue where official workspace images displayed broken icons instead of falling back to the registry image when the icon was not available locally.
  • Fixed issue where the Kasm Go URL did not execute the configured Docker exec command on the initial workspace launch, only on subsequent resumes.
  • Fixed issue where the v4l2loopback kernel module failed to compile on kernel 6.17.
  • Fixed issue where setting a very large API Token Lifespan value caused the Guacamole service to continuously restart due to a JavaScript timer overflow.
  • Fixed issue where the Kasm Smart Card Bridge became unresponsive after a Chrome 145 browser upgrade due to a change in Chrome's extension messaging API.
  • Fixed issue where the rolling images flag was not passed correctly when upgrading the database role in a multi-server deployment.
  • Fixed issue where workspace sessions failed to launch when a DLP watermark was configured via file mapping.
  • Fixed issue where creating a zone via the API incorrectly defaulted verify_rdp_client_ip to true instead of false.
  • Fixed missing translation strings.
  • Fixed issue where cloud provider servers (including OCI) could be incorrectly marked as orphaned and have running sessions forcefully terminated when the provider API failed to list instances or returned an empty result.
  • Fixed bug where the Proxmox Provider would fail when a node in the Proxmox cluster was non-responsive or offline.
  • Fixed issue where delays in provisioning could erroneously allow a user to create multiple sessions.
  • Fixed multiple minor bugs in AWS provider module, regarding broken logging and crash handling.
  • Fixed an issue where the connection proxy recording pipeline failed to encode .guac segments after the first successful upload. Added information about encoding failure and recovery.
  • Fixed edge case where input data was not properly reset after completion.
  • Fixed datastore cluster support for VMware vSphere autoscaling, enabling automatic datastore placement via vSphere when cloning from templates.
  • Fixed issue with maximum simultaneous sessions settings in server where connection_type is ssh.
  • Fixed issue where end users selecting a deployment zone in an pool for servers was not respected.
  • Fixed issue where Proxmox full clones fail when clone time is longer than a couple of minutes.
  • Fixed issue where a database session from the Kasm API service remained in an "idle in transaction" state indefinitely after startup.
  • Fixed issue where the drain settings for an autoscale configuration were not included when cloning the configuration.
  • Fixed an issue where session recording was not working with the KasmOS image.

Rolling Bug Fixes​

info

If you upgraded to 1.19.0 before 07/21/2026 and had explicitly disabled local logging by setting Log Retention or Debug Log Retention to 0, a migration bug could have silently reset that setting back to its default and re-enabled central database storage for that log category. Check your Log Retention and Debug Log Retention settings to confirm they still reflect your intended configuration.

The following fixes have been made in the rolling tagged versions of the Kasm Workspaces container images.

  • Kasm Workspace Images

    • (07/12/2026) Fixed a bug in the Kasm Webcam Server where it would crash if FIPS was enabled.
    • (08/01/2026) Added Ollama to AnythingLLM to support the built in AnythingLLM model engine for local AI use cases.
    • (08/01/2026) The following fixes have been made in the rolling tagged versions of the Kasm Workspaces container images.
    • (08/01/2026) Fixed an issue with the v4l2loopback module where it would fail to build on kernel version 7.
    • (08/06/2026) Profile sync filters now more reliably exclude matched folders and their contents.

  • Kasm Service Images

    • (06/02/2026) Fixed search functionality in the Users table under the Groups section.
    • (06/23/2026) Fixed database session leak when an error occurs downloading a support bundle
    • (07/01/2026) Added support for staging sessions with gateway/gateway-credential based egress.
    • (07/31/2026) Improved logging and exception handling issues with autoscale VM providers.
    • (07/31/2026) Fixed a bug where ordering by zone on autoscale configs returned an empty page and wasn't easily recoverable.
    • (08/05/2026) Fixed local log cleanup not actually deleting expired rows, so Log Retention and Debug Log Retention limits were not enforced.
    • (08/05/2026) Fixed installs left with legacy, pre-1.19.0 Log Retention/Debug Log Retention defaults instead of the intended row-count based defaults; affected installs are now automatically corrected.
    • (08/10/2026) Fixed an issue where the Session Casting configuration's "Restrict to Referrers" setting did not deny requests when the Referer header was missing.
    • (08/14/2026) Fixed an issue where the Dedicated Kasm Proxy did not re-resolve the API hostname after its DNS record changed, causing it to keep connecting to the previous IP address until nginx was reloaded or the container was restarted.
    • (08/18/2026) Fixed issue where Digital Ocean autoscale provisioning failed due to changes in the Digital Ocean API.

  • Guacamole

    • (07/30/2026) Fixed noisy WebSocket error logs for pure RDP sessions over guac.
    • (06/23/2026) Fixed database session leak when an error occurs downloading a support bundle
    • (07/13/2026) Fixed an issue where the server did not properly parse boolean config values, such as disabling SSL.
    • (07/01/2026) Added support for staging sessions with gateway/gateway-credential based egress.
    • (08/01/2026) Made the API server request thread pool size configurable by setting thread_pool (defaults to 20) under server in api.app.config.yaml, and added optional periodic logging of thread-pool utilization by setting thread_pool_log_interval (in seconds; 0 disables) in the same file.
    • (08/01/2026) Fixed issue where provisioning failed when an autoscale startup script exceeded the provider's user data size limit. A minimal bootstrap script that downloads and runs the full script is now provided.
    • (08/10/2026) Fixed kasm_agent restart loop caused by ghost Docker containers during clear_stale_mounts.
    • (08/10/2026) Fixed issue where Guac Connection Proxy Fails to Recover from Expired Token.
    • (08/13/2026) Fixed issue where group permissions bound to an API key were silently dropped during system configuration import.

  • Kasm UI

    • Security Fixes
    • (06/02/2026) Fixed search functionality in the Users table under the Groups section.
    • (07/02/2026) Fixed table filters resetting after item deletion.
    • (07/13/2026) Fixed duplicate session start requests triggering initialization scripts multiple times.
    • (07/13/2026) Fixed the startup race condition between kasm_guac and the proxy, which caused kasm_guac to permanently fail to start if the proxy not ready.
    • (06/02/2026) Fixed search functionality in the Users table under the Groups section.
    • (06/23/2026) Fixed database session leak when an error occurs downloading a support bundle
    • (07/01/2026) Added support for staging sessions with gateway/gateway-credential based egress.
    • (07/10/2026) Fixed backend validation for workspace file-download requests.
    • (07/22/2026) Fixed error on accessing cloud storage tab using non-admin user.
    • (07/31/2026) Ordering by invalid properties should no longer break any pages.
    • (09/02/2026) Fixed session preview images overflowing the window height.

  • Kasm Network Plugin

    • (08/13/2026) Fixed an issue where long running ziti egress never rotated logs leading to disk pressure

  • Kasm Installer

    • (08/05/2026) Fixed the log retention migration re-enabling local log or debug logging that had been explicitly disabled (set to 0) during an upgrade or downgrade.