distronews.com stable7.3.1
VyOS Blog

VyOS Project October 2026 Update

blog.vyos.io

Key points

VyOS' monthly update covers what landed in the Rolling release in September and October. Much of it fixes commits that touched more than they should, such as BGP sessions or OSPF adjacencies reset by an unrelated change. It also adds MPLS Inter-AS switching, BGP-LS for SRv6 and VXLAN-GBP, and includes an OIDC API flaw that Rolling users should read about before upgrading.

Security fixes

  • The API's OIDC authentication did not check the token audience when none was configured, so any valid token from the identity provider got full API privileges. It affected Rolling builds from 2026-09-02 to 2026-09-29; LTS never had OIDC. The audience is now required, and a configuration without it will not commit (T8989).
  • The PPTP server ignored mppe require; unencrypted clients are now refused (T9462).
  • PPPoE, IPoE, L2TP, PPTP and SSTP servers can send and require the RADIUS Message-Authenticator against Blast-RADIUS (CVE-2024-3596). Check that the RADIUS server supports it first (T9351).

Safer, faster commits

  • Five options written differently from how FRR prints them were removed and re-added on every commit: bgp parameters reject-as-sets and ORF prefix-lists reset BGP sessions, default local-pref 100 re-processed every route (about 140 s instead of 16.5 s with 1.76 million paths), ospf parameters opaque-lsa reset adjacencies, and OSPF default-information with metric-type 2 flushed external routes (T9407, T9360, T9404, T9441, T9448).
  • On upgrade, protocols ospf parameters opaque-lsa migrates to protocols ospf capability opaque and is removed from VRF instances.
  • A duplicate FRR save (almost two minutes per commit in one test) and a double read (77-78 s with a 10,000-rule prefix-list) are gone (T9377, T9399, T9379).
  • DHCP lease events now wait for a running commit, fixing a race from 2026-09-08 that could skip the FRR reload (T9368).
  • Deleting an interface still used by OSPF, QoS or NTP now stops the commit instead of breaking the next boot (T7886).

Routing

  • Inter-AS option B (RFC 4364) label switching per interface (T9338). FRR is now 10.7.1 (T9454).
  • IS-IS with SRv6 can feed BGP-LS (T9227); SRv6-only IS-IS no longer turns on SR-MPLS (T9485).
  • EVPN anycast gateways sharing a MAC on a VLAN-aware bridge commit and survive reboot (T9253).
  • VXLAN-GBP carries firewall marks across tunnels (T9319). The field is not authenticated: use it only on a trusted underlay.

Firewall, NAT, DHCP, VPP and OpenVPN

  • Time windows crossing midnight UTC now match, and DST or time zone changes no longer shift them (T9474). GeoIP, match-frag and failed nftables commits were also fixed.
  • NAT load-balancing weights are now shares of their sum; weights not adding up to 100 will change traffic distribution (T9475).
  • DHCP client classes match option 12 or 60 (T9267); a client watchdog restarts renewals overdue by 15 minutes (T9108).
  • VPP rejects MTUs above the NIC limit and receives frames into one buffer: 84 to 140 Mpps with 64-byte packets on 100G ConnectX-6 (T9161, T9146).
  • OpenVPN DCO defaults to MTU 1420 and accepts ChaCha20-Poly1305; site-to-site keepalive timeout is now 600 s by default (T9364, T9370, T9363).

Before upgrading

  • reset connection becomes reconnect interface <ifname>, with no alias; the API path is /reconnect (T9354).
  • Commit-archive locations are now named, with separate nodes; URLs with unsupported schemes are dropped (T6304).
  • Commits warn about IKEv1, which strongSwan 6.1.0 disables (T9320). The DNS forwarder stops PowerDNS security polls by default (T9175).
  • The WAN load-balancing TTL test was inverted: an uplink shown as ACTIVE may be down (T9472).
set service https api rest authentication oidc audience <txt>
set service pppoe-server authentication radius message-authenticator require-access-response
set protocols bgp interface eth1 mpls l3vpn-multi-domain-switching
set interfaces openvpn vtun0 encryption data-ciphers chacha20poly1305

Also

  • Rolling moves to kernel 6.18.57 and HAProxy 3.0.29 (T9470, T7142). Intel BE200 and AX2xx Wi-Fi firmware is back (T9197).
  • About a third of the changes came from outside the core team, including fixes for doubled remote syslog messages, API crashes under concurrent requests and ? being dropped from quoted CLI values.

Summary by DistroNews, based on the original post.

Hello, Community! This update covers the changes that landed in Rolling in September and October, and looking back, the month has a theme that nobody planned. A commit is a promise: change what I asked for, and leave everything else alone. This month, we found several places where VyOS broke that promise. With certain routing options set, a commit that only touched a route-map description could reset BGP sessions or OSPF adjacencies. Elsewhere, configurations committed without complaint and then quietly did something else. Much of this post is about closing those gaps, and about the community members who found several of them on their own routers. There is new ground too: MPLS Inter-AS label switching, BGP-LS for SRv6, a VXLAN extension that carries firewall marks, and updates to DHCP, VPP, and OpenVPN. Please read the security section before you upgrade.

This is the summary VyOS Blog published with the story. The full text is on the original page.

Read the original at blog.vyos.io