We have identified security vulnerabilities affecting Internet-facing Turbo Portal servers. We have observed exploitation of some of these vulnerabilities against Internet-facing deployments.

Depending on your deployment's configuration, these vulnerabilities could expose account login names (including email addresses used for sign-in), group names, server configuration details, and single sign-on secrets. Other vulnerabilities could potentially allow unauthorized access.

If your Turbo Portal is accessible from the Internet, please update your Turbo Server deployment to version 25.5.5.3147 as soon as possible. This release includes fixes for these vulnerabilities.

Download Turbo Server 25.5.5.3147

Who should take action

This notice is directed to administrators and security teams responsible for Turbo Portal servers accessible from the Internet. Please ensure that the administrator responsible for your deployment receives this notice and completes the update and security actions below.

Additional security actions

Installing the update addresses the patched vulnerabilities, but it does not invalidate credentials or unauthorized API keys that may already have been obtained. Complete these additional steps to address potential exposure before the update:

1. Replace configured single sign-on secrets and signing keys. If your deployment has OpenID Connect configured, rotate the associated client secrets and update the configuration in Turbo Server, even if the provider is unused. If SAML request signing is configured, replace the signing key and certificate as well. Take these steps even if you have no evidence of exposure.
2. Review API keys. Have your administrator review the API-key list and remove unauthorized keys. The automatically created Default key is expected and should not be deleted.
3. Preserve and review relevant logs. Restrict access to logs created before the update, including archives and support bundles, because they may contain sensitive credentials. Preserve relevant records for investigation rather than deleting them during your initial response.

Questions

If you have any additional questions or suspect unauthorized activity, please contact Turbo Support.

We apologize for these vulnerabilities and the work required to address them. Thank you for your prompt attention to this update.