The big addition in v0.81 is path-based access on the Reverse Proxy. An HTTP target can keep the service's authentication, skip it, or block the path. This release also adds a certificate posture check, an unprivileged forwarder called nblink, and a Duplicate action for policies.
If you self-host, MySQL is now deprecated. Traefik, CrowdSec, and the optional AppSec plugin also need separate updates, and the dashboard will not flag those for you.
Path Access on Reverse Proxy Services
Until now, every path on a Reverse Proxy service inherited that service's authentication. HTTP targets can override it. Under a target's Optional Settings, the Access action has three choices:
| Action | What it does |
|---|---|
| Use service authentication | Apply the authentication configured on the service. This is the default. |
| Bypass authentication | Skip SSO, password, PIN, and header authentication for this path. CIDR, country, and CrowdSec restrictions still apply. |
| Block access | Return without contacting the backend. |
A service can require SSO on , skip auth for a webhook or health check on or , and block or from the public domain entirely.
Matching uses the longest case-sensitive literal prefix. Once any target sets an access action, the proxy rejects ambiguous paths (, , encoded separators) with before it tries to match. Targets that override the default are marked in the services list.
Upgrade every proxy in the cluster before you use these actions. An older proxy ignores them and keeps applying the service authentication. NetBird-Only services can't use these actions yet. Support for that is in progress. Bypass authentication is also unavailable on Agent Network targets.
The setup details are in Per-target access actions. This shipped across #8114, #8115, #8116, #8117, and dashboard#823.
Certificate Posture Checks
The peer has to hold a device certificate issued by a CA you trust, and it has to sign a challenge from management so you know the private key is still on that machine. A copied certificate with no key fails. Management repeats the challenge every 4 hours while the peer is connected, so a removed key or an expired certificate closes access inside that window.
The client uses the operating system's own certificate stores:
- Windows: the Local Computer store and the user Personal store, TPM-backed keys included.
- macOS: the System and login keychains, Secure Enclave keys included.
- Linux: PEM files in , TSS2 key files, or a tpm2-pkcs11 token.
In the dashboard, go ahead and paste one or more root or intermediate CA certificates, then attach the check to any access policy. The dialog shows a SHA-256 fingerprint for each CA you add.
Do note that management and the client both need v0.81.0 or newer. The iOS and Android apps cannot produce this proof, so they always fail the check and get denied. Leave it off any policy a phone needs to pass.
The full setup is in Requiring a device certificate. The related changes are #7535, #8052, #7890, #8174, and dashboard#798.
nblink
The regular client creates a TUN device, which needs privileges. nblink is a separate binary for the places that cannot have that: managed laptops without admin rights, rootless containers on OpenShift and Podman, CI jobs, and local AI agents or MCP servers that need an internal API.
It runs the client in userspace, so there is no TUN device, no root, and no installer, and it never touches . Names on the upstream side resolve inside the tunnel. It also works as a sidecar for an app that hardcodes an HTTP endpoint.
With no setup key, nblink opens a browser for login and always prints the URL, so the same command works over SSH. The peer gets a real identity, so your policies decide what it can reach.
This release forwards HTTP. Raw TCP, UDP, and SOCKS5 are planned, with the same syntax.
Binaries are on the v0.81.0 release for Linux, macOS, and Windows, named . Container images are and . The nblink documentation has more examples, and you can follow the implementation in #7955.
Duplicate Policies
Access Control and Agent Network policies now have a Duplicate action in the row menu. It opens the create wizard filled in from the source policy, named . Nothing is saved until you click Add Policy, so you can change the group or the port and close it if you don't want the copy.
Groups, posture checks, resources, providers, and guardrails stay shared. The new policy points at the same objects. Pretty handy when a policy is almost right and you only want a different destination group.
You can find the workflow under Managing Policies. This came from dashboard#841.
MySQL Is Deprecated
If your self-hosted management store is MySQL, move it to PostgreSQL. Support for MySQL will be removed in an upcoming release. SQLite and PostgreSQL stay fully supported.
This release adds , which moves your deployment's data into PostgreSQL. The steps are in the MySQL to PostgreSQL migration guide. The tool is #8095.
Self-Hosted: Update Traefik and CrowdSec
Upgrading NetBird does not move Traefik, CrowdSec, or the optional Traefik CrowdSec bouncer plugin. The dashboard indicator and the version API only report NetBird components. downloads the tags already written in your Compose file. It does not change those tags, and it does not apply newer installer defaults to a deployment you already have. A newer Vultr marketplace image works the same way: it does not update an instance that is already running.
These versions were validated for self-hosted NetBird as of October 9, 2026:
| Component | Validated version |
|---|---|
| Bundled Traefik | |
| CrowdSec | |
| Traefik CrowdSec bouncer plugin |
The plugin version is the flag in Traefik's list. Changing the CrowdSec image does not update it. If you never enabled dashboard AppSec, you can skip the plugin.
I do recommend moving Traefik if you are still on v3.0.0 through v3.7.11. Those releases are affected by header-alias spoofing, GHSA-rf44-j88r-hh8c. On the way to v3.7.14, add these to the existing Traefik list:
removes request headers whose names contain anything other than letters, digits, and hyphens. That includes legitimate headers such as , so check custom integrations before you enable it. These flags require Traefik v3.7.12 or newer.
Change one container at a time and back up first. Leave alone because rerunning it is not an upgrade procedure, and skip because that removes volumes, including certificates and the CrowdSec database. The pull, verification, and rollback steps are in Upgrading Traefik and CrowdSec.
The quickstart in this release fixes Traefik versioning and bumps CrowdSec (#8152). That only helps a new install. Your existing Compose file keeps the tags it already has.
For the NetBird containers, pull and , and if you run the reverse proxy. This dashboard release is v2.95.0. Keep management and the proxy on the same version. Since v0.76.1, a proxy newer than management silently skips Agent Network LLM cost metering. If you are turning on the new path access actions, every proxy in the cluster has to be on this release first.
The Let's Encrypt challenge listener address is now configurable for management and signal (#7706). The normal NetBird upgrade steps, including the legacy separate-container layout, are in the upgrade guide.
Also in v0.81
- You can search peers by MAC address (#6553, dashboard#683). There is also an account setting that returns an error when AddPeer hits a name that is already taken (#8154, dashboard#851).
- Relayed connections in kernel mode no longer use the eBPF WireGuard proxy (#7316). One unreachable relay no longer churns the connections on the others (#8098, #7092).
- The Windows UI exit on first launch is fixed (#8138). The desktop UI also picks up RTL layout and Galician (#8076, #7041).
- Cluster and direct upstream targets now require a private proxy cluster (#7984). You can also refuse private addresses on direct-upstream dials (#7913).
- OpenCode and Pi are in Connect Agent, with a provider and model picker (dashboard#856, dashboard#816). Agent Network onboarding is shorter, including for an existing empty account (dashboard#822).
- Management, signal, relay, the combined server, and the dashboard now ship a Red Hat UBI variant. The dashboard tag suffix is (#8167, dashboard#829).
- The OIDC session handoff between management and the proxy uses single-use codes (#7635, #7981). JWT validation now requires strict base64url decoding (#7554).
- An expired or invalid setup key now returns a specific permission-denied error instead of a generic failure (#8086).
First-time contributors this release: @a-elkaim, @redouan-rhazouani, @janekhaertter, @B1NAR10, and @emrcbrn. Thank you.
Go Ahead and Upgrade
- Release: NetBird v0.81.0 on GitHub
- Full changelog: v0.80.0...v0.81.0
- Path access: Per-target access actions
- Certificate checks: Requiring a device certificate
- nblink: nblink
- MySQL migration: MySQL to PostgreSQL
- Self-hosted containers: Upgrading Traefik and CrowdSec
With all that, go ahead and get updated. If the management store is still on MySQL, start the Postgres move before a later release takes the option away.