# NetBird v0.76.0

- Product: NetBird (https://whatsnew.fyi/product/netbird)
- Vendor: NetBird
- Date: 2026-07-29
- Version: v0.76.0
- Original notes: https://github.com/netbirdio/netbird/releases/tag/v0.76.0
- Permalink: https://whatsnew.fyi/product/netbird/releases/v0.76.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix local privilege escalation in the client daemon by requiring root or administrator privileges to enable the SSH server, enable SSH root login, disable SSH authentication, or change the management URL or deregister the peer while the SSH server is enabled
- **changed** — Derive each local caller's identity from the kernel in the daemon's local control interface
- **changed** — Serve a named pipe instead of loopback TCP on Windows for the daemon's local control interface
- **changed** — Automatically migrate existing Windows installations to use the named pipe instead of loopback TCP
- **added** — Expose RenameProfile in the Android profile manager binding
- **changed** — Build UI release binaries with the production tag
- **fixed** — Escape dots in interface names for sysctl configuration
- **fixed** — Serialize iOS tunnel reconfiguration callbacks
- **changed** — Unify route selection in the route manager
- **changed** — Parse NB_LAZY_CONN_INACTIVITY_THRESHOLD as a Go duration
- **added** — Export peer details for Android
- **fixed** — Add explicit accountID check when deleting a user
- **deprecated** — Deprecate legacy Dex and Zitadel getting-started scripts
- **fixed** — Fix UI crash on Windows builds without dark-mode support
- **changed** — Make pprof configurable in the signal component
- **changed** — Force routing-peer DNS resolution for reverse-proxy domain targets
- **changed** — Read reverse-proxy service and target columns in Postgres path

##### Security

Fixes a local privilege escalation in the client daemon (https://github.com/netbirdio/netbird/security/advisories/GHSA-qcpp-8vwj-hhwr). The daemon's local control interface accepted any local caller without authentication, so an unprivileged user on the same machine could enable the embedded SSH server, turn on SSH root login and disable SSH authentication, and then open a root shell. Every version from 0.5.0 to 0.75.1 is affected: on Linux, macOS and FreeBSD through the world-writable Unix socket, and on Windows through the loopback TCP listener, which carried no caller identity at all. Reported by @neewek.

The daemon now derives each local caller's identity from the kernel and requires root, or an administrator on Windows, to enable the SSH server, enable SSH root login, disable SSH authentication, or to change the management URL or deregister the peer while that profile has the SSH server enabled. On Windows it serves a named pipe instead of loopback TCP, and existing installations are migrated automatically.

Upgrade note: if you enable any of those settings from a script or an unprivileged session, run the command with sudo, or from an elevated prompt on Windows. Turning them off is unchanged, and so is everything else on the socket.

Learn more [here](https://netbird.io/knowledge-hub/security-advisory-daemon-ipc-local-privilege-escalation)

##### What's Changed
* [management] Force routing-peer DNS resolution for reverse-proxy domain targets by @lixmal in https://github.com/netbirdio/netbird/pull/6872
* [management] Read reverse-proxy service and target columns in Postgres path by @lixmal in https://github.com/netbirdio/netbird/pull/6886
* [client] Expose RenameProfile in the Android profile manager binding by @pappz in https://github.com/netbirdio/netbird/pull/6926
* [client] Build UI release binaries with the production tag by @pappz in https://github.com/netbirdio/netbird/pull/6898
* [client] Escape dots in interface names for sysctl configuration by @stefan-fast in https://github.com/netbirdio/netbird/pull/6930
* [client] Serialize iOS tunnel reconfiguration callbacks by @pappz in https://github.com/netbirdio/netbird/pull/6870
* [client] Unify route selection in the route manager by @pappz in https://github.com/netbirdio/netbird/pull/6928
* [client] parse NB_LAZY_CONN_INACTIVITY_THRESHOLD as a Go duration by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6947
* [client] Export peer details for Android by @pappz in https://github.com/netbirdio/netbird/pull/6925
* [management] explicit accountID check when deleting a user by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6944
* [infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts by @TechHutTV in https://github.com/netbirdio/netbird/pull/6952
* [client] Fix UI crash on Windows builds without dark-mode support by @lixmal in https://github.com/netbirdio/netbird/pull/6958
* [signal] make pprof configurable by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6963
* [client] Authorize daemon IPC callers by their local identity by @lixmal in https://github.com/netbirdio/netbird/pull/6967

##### New Contributors
* @stefan-fast made their first contribution in https://github.com/netbirdio/netbird/pull/6930
* @TechHutTV made their first contribution in https://github.com/netbirdio/netbird/pull/6952

**Full Changelog**: https://github.com/netbirdio/netbird/compare/v0.75.1...v0.76.0