Skip to content

Privileged Access Bridge — Changelog

Release notes for the Blackfort Privileged Access Bridge (PAB). Newest version first. Versioning follows Semantic Versioning.

Product maturity

PAB combines a newly built, hardened Blackfort portal with a mature session engine. The portal is under active development; these notes describe only features that are actually available.

1.0.0 — 2026-07-01

First publicly documented version of the agentless PAM gateway.

Added

  • Agentless access through the browser — nothing is installed on the client or the target system.
  • Protocol breadth: RDP, SSH, VNC, Telnet and Kubernetes through a single interface.
  • Session recording with playback in the portal (recording viewer).
  • Real-time supervision: a supervisor can follow live sessions read-only and end them immediately via an emergency stop.
  • File transfer into the session through a convenient file browser with folder navigation, multi-select and bulk download; clipboard synchronisation.
  • Backend-for-Frontend (BFF) as a security and supervision layer: the session token stays server-side, the browser only receives an HttpOnly+Secure+SameSite=Strict cookie (CSRF protection via double-submit token); roles and emergency stop are enforced at the BFF.
  • Hardened edge: strict Content Security Policy, HSTS, rate limiting and security headers for internet-facing operation.
  • Connection and user management in the portal.
  • Version display (portal build) in the "System" area.

Security

  • Login hardened to use the real client IP (prevents false login lockouts behind a reverse proxy).
  • Updated the session playback library to fix a known vulnerability (CVE-2025-59288).