Releasesby IbisNode.js October 2026 security vulnerabilities (CVE-2026-111497)
UpdateyesterdayUnverifiedAdded Oct 24, 2026
A vulnerability in Node.js , the runtime that Retool runs on, can allow remote code execution. An out-of-bounds write in the Node.js Brotli decoder can be triggered by a crafted, Brotli-compressed HTTP response. Many of the HTTP clients that Retool uses decompress Brotli responses automatically.
Topics: Security, Data integration, Developer tools
More Retool releases
Every Retool releaseSelf-hosted Retool 4.34 and 4.0 stable updates
The following patches are now available on the Stable release channel: Retool 4.34.12 Retool 4.0.25 Update your Retool instance to apply the latest bug fixes and security patches.
Self-hosted Retool 4.34 and 4.0 stable updates
The following patches are now available on the Stable release channel: Retool 4.34.10 Retool 4.0.23 Update your Retool instance to apply the latest bug fixes and security patches.
Retool 4.78 Edge for self-hosted instances
Retool 4.78 is now available on the Edge release channel for self-hosted organizations.
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
Summary PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is an upstream PHP vulnerability. Retool is not affected. PHP does not run on anything internet-facing, nor does it run in our production environments. No action required. What Happened PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a set of vulnerabilities in PHP.
Gemini 4 Argon available in Retool
Live on cloud Gemini 4 Argon is now available in Retool through Google and Google Vertex AI. It is available to Enterprise organizations that bring their own key . Use Gemini 4 Argon with AI resource queries and building apps .
Expanded source control managers for multi-instance releases
Live on cloud Enterprise organizations can now implement multi-instance releases for apps using any supported SCM provider: AWS CodeCommit, Azure Repos, BitBucket, GitHub, and GitLab. To enable multi-instance releases, navigate to Settings > Source control > Edit settings and turn on Enable multi-instance releases .
New AI models available in Retool
Live on cloud Retool now supports the following new AI models: GPT 6.1 Sol through OpenAI for AI resource queries and building apps . Claude Sonnet 5.5 through Anthropic and Amazon Bedrock for AI resource queries and building apps .
Build resource environment switching for published apps
Live on cloud • Team • Business • Enterprise Public beta Organizations on paid plans can prompt the app building agent to use resource environments in published apps.
Also shipped on Oct 23, 2026
Retool in October 2026Retrieve Cortex Search (Public Preview)
The CORTEX_SEARCH_RETRIEVE table function is now in public preview, allowing users to execute low-latency search queries directly from SQL for RAG and chatbot applications.
DataFrame caching on serverless compute is now in Public Preview
Databricks now supports DataFrame caching on serverless compute via df.cache() or df.persist(), allowing users to reuse results within a session.
Box Audit Logs managed ingestion connector (Beta)
The Box Audit Logs connector for Lakeflow Connect is now available in beta, enabling the ingestion of enterprise audit events into Databricks.
Manage Test Engine workflows with Terraform and the REST API
Users can now manage Test Engine workflows using the buildkite_test_suite_workflow Terraform resource or the REST API, enabling code-based configuration of monitors and actions.
Flagship - Target Flagship feature flags with structured evaluation context
Flagship now supports nested objects and arrays in evaluation context, allowing developers to target feature flags based on complex user profiles and tags.
Responses API for the Cortex REST API (Preview)
The new Responses API in the Cortex REST API provides OpenAI-compatible endpoints for accessing models.