Cloudron 10.1

We are happy to announce the release of Cloudron 10.1!

Last week was a frantic one, with multiple security vulnerabilities. PHP RCE, the eMudhra cert compromise and GitLab CVE-2026-110264.

We have been on top of all this. All our app packages have been updated to fix the issues. We were also posting as we went on social.cloudron.io and X.

Cloudron 10.1 brings a major image update, new database versions, an improved installation flow, tons of bug fixes, and an updated Node.js that fixes the eMudhra security issue.

Base image update #

The Cloudron app base image, which is shared across all apps, is now based on Ubuntu 26.04.

We have rebuilt all the App Store packages on it. If you still have pending app updates sitting on the dashboard, install those.

If you build your own packages, please move to the latest images. The full table is in the packaging cheat sheet.

Database updates #

PostgreSQL is now 18 and MongoDB is 8.3. On the mail side, Dovecot moved to 2.4.

We had to do the Postgres jump because some apps like GitLab and Moodle already require the newer version. Cloudron migrates existing databases automatically as part of the platform update. You do not have to dump or restore anything by hand.

Improved installation flow #

Until now, you hit a self-signed certificate after installing Cloudron. Thanks to Let’s Encrypt IP address certificates, the installation page now gets a valid trusted certificate.

SQLite backups #

We used to back up SQLite databases as SQL text dumps. That format does not carry the whole database. Header bits like PRAGMA settings were missing, and restores could come back wrong.

We have switched to a backup-style dump (VACUUM INTO). That writes a real SQLite file, so the header and pragmas survive restore.

Other notable changes #

• Email when the mail status check fails
• Invite and password reset links expire after 24 hours
• API tokens and login tokens are stored hashed
• Users are edited on their own page, not a dialog
• LDAP users and groups get a badge
• Token exchange so first-party apps can talk to mail and each other without passing the user’s token around
• HSTS and related headers on error pages
• Redis backup and restore with the non-persistent flag
• Mail no longer keeps the previous hostname in SPF after a rename
• Fix crash when stopping an integrity check

What’s coming next #

Head over to our forum to learn more about What’s coming in our next release - 10.2.

Install Cloudron #

New to Cloudron? Get started for free by running with 3 simple commands on your server.

wget https://cloudron.io/cloudron-setup
chmod +x ./cloudron-setup
./cloudron-setup