Skip to main content
Use the filters on the right side of this page to narrow down the updates by component. You can select multiple filters at the same time to refine your results.
Upcoming collector deprecationBloodHound Enterprise will soon ingest collector property values exactly as collectors send them instead of normalizing values during ingest. Older AzureHound and OpenHound versions depend on server-side normalization and can create duplicate nodes or identity mismatches when this change is enabled.Starting with the November 2026 release, BloodHound Enterprise will reject client and file ingest uploads from deprecated AzureHound and OpenHound versions.Upgrade AzureHound and OpenHound before then to keep data collection compatible with future versions of BloodHound Enterprise.
​
OpenGraph
New Feature

​
Dynamic Entity Panel Content

Render selected-entity data in custom OpenGraph Entity Panel sections with Go templates in extension definition schemas.BloodHound validates template syntax when you upload the schema, helping you catch invalid templates before they reach the Entity Panel. Dynamic Markdown supports node and relationship properties, conditional content, and supported helper functions.
​
Administration
New Feature

​
Alerts Early Access

Applies to BloodHound Enterprise onlyCreate reusable generic HTTPS webhooks, connect them to configurable rules, and review delivery attempts.The initial release of Alerts supports the Collector Offline event type and Webhook delivery method to monitor collector availability. You can configure rules to trigger when a collector is offline for a specified duration and BloodHound Enterprise will send an alert to the configured webhook URL.
This feature is available through Early Access. Enable on the Administration > Early Access Features page to access it.
This feature introduces new APIs to manage alerts. You can use them to programmatically manage webhooks and rules, inspect event types, events, and delivery attempts, test webhook destinations, rotate webhook secrets, and retry failed deliveries:
​
Data Collection
New Feature

​
Collector Support Bundles

Applies to BloodHound Enterprise onlyRequest, download, and delete diagnostic support bundles from the Manage Clients page for SharpHound Enterprise and OpenHound collector clients.SharpHound Enterprise v2.16.0 or OpenHound v0.4.0 are prerequisites for this feature.
This is a SpecterOps-managed feature. If it is not enabled in your environment, contact your account team for assistance.
This feature introduces new APIs to manage support bundles for collector clients. You can use them to programmatically request, download, and delete support bundles, as well as retrieve available management operations and upload artifacts for management operations:
​
Administration
New Feature

​
Enterprise Marketplace

Applies to BloodHound Enterprise onlyDiscover supported OpenGraph extensions, community extensions, and integrations from the new Marketplace page.This initial release includes search, filtering, and links to learn more, with expanded Marketplace capabilities planned for future releases. Click the icon in the left navigation panel to open the Marketplace page.
​
Accessibility
Enhancement

​
Accessibility Improvements

Navigate BloodHound with clearer focus indicators, improved keyboard navigation, more useful screen-reader announcements, and chart colors.Form validation, posture results, environment selection, data tables, administration, and Zone Builder receive additional accessibility coverage and behavior improvements.
​
Explore
Enhancement

​
Accessible Explore Toolbar

Navigate the Explore graph toolbar with accessible icons, tooltips, improved keyboard behavior, and clearer screen-reader labels.BloodHound Enterprise can also provide optional export actions in the Export menu while retaining JSON as the default export format.
​
Explore
Enhancement

​
Multi-Destination Pathfinding

Build a pathfinding query through up to three destination nodes, which can help focus the results on a specific set of nodes.BloodHound now supports up to four pathfinding nodes total: one source and three destinations. You can reorder nodes, remove destination nodes, and review the combined graph result for the selected route.
​
Attack Paths
Enhancement

​
Protection Score

Applies to BloodHound Enterprise onlyEvaluate the protection of assets in each Privilege Zone with the new Protection Score on the Posture page.The score shows the percentage of objects in the selected zone that do not have Attack Path findings, helping you identify where protection requires attention over time.This feature introduces a new API to retrieve protection score results for Privilege Zones. You can use it to programmatically retrieve the protection score for a specific Privilege Zone or for all Privilege Zones in the current environment:
​
Attack Paths
Enhancement

​
Findings Table Early Access

Applies to BloodHound Enterprise only
This feature is available through Early Access. Enable on the Administration > Early Access Features page to access it.

​
Actions

An action bar is now available when you select findings in the Findings Table. The action bar allows you to open a finding’s remediation plan or pivot directly to the Explore page for further investigation.

​
Filtering and Context

This release also includes the following enhancements to the Findings Table filtering behavior:
  • Default-selected filters now use an outlined enabled state and visually change when you modify their selections, so you can distinguish filters that remain at their defaults from filters you changed.
  • Use the new Attack Path filter to select one or more Attack Path types and limit the table to matching findings.
  • View the total number of findings that match the current filter selections in a count displayed above the table. The count updates as you change the filters.
  • Open a finding in the Findings Table from its Attack Path details in the Graph view. The finding’s status, environment, and Privilege Zone context are carried into the table so you can continue the investigation with the relevant filters applied.
​
Data Collection
Enhancement

​
GitHub Enterprise Server Endpoint Support

Configure separate rest_api_url and graphql_url values to collect data from GitHub Enterprise Server. GitHub.com remains the default, so existing configurations continue to work without changes.The endpoint settings must use HTTPS, share the same origin, and be configured together. GitHub App authentication and PAT validation now use the configured REST endpoint instead of assuming GitHub.com.
​
Data Collection
Enhancement

​
GitHub and Okta Collection Resilience

Improve collection reliability for large environments and organization-scoped GitHub collection runs.
  • The Okta collector pages expanded group requests and retries the initial request with limits of 200, 100, and 50 when a timeout persists. You can tune these and other Okta resource page sizes with the new pagination settings.
  • The GitHub collector reduces repository GraphQL page sizes from 100 to 50 and then 25 after transient gateway failures, then returns to the default page size when later pages succeed.
  • Organization-only GitHub collections also resolve the canonical organization login before resource collection begins, preventing case-sensitive lookup failures.
​
Data Collection
Enhancement

​
GitHub Enterprise Role Memberships

Restore accurate membership data for the synthetic GH_EnterpriseRole owners and members roles across supported GitHub authentication configurations.OpenHound now uses the available enterprise or organization-backed collection paths to populate GH_User -[:GH_HasRole]-> GH_EnterpriseRole relationships.
​
Data Collection
Enhancement

​
GitHub EMU External Group Modeling

Collect external identity-provider group metadata for normal GH_Team nodes in GitHub Enterprise Managed User organizations.OpenHound adds the external_group_id and external_group_name properties and emits a SCIM_Provisioned relationship to the matching SCIM_Group when the corresponding SCIM data is available.
​
Data Collection
Enhancement

​
Authoritative Okta Application-Group Assignments

Collect group-to-application assignments from Okta’s application assignment endpoints instead of relying on group statistics that may be stale.The collector preserves the existing Okta_AppAssignment relationships and assignment evidence while failing closed when required assignment data is incomplete or ambiguous.
​
Data Collection
Enhancement

​
OpenHound Logs

Review collector lifecycle logs to identify the collector name and version, OpenHound version, and job ID, making it easier to troubleshoot collection runs.
​
Data Collection
Enhancement

​
OpenHound Configuration

Applies to BloodHound Enterprise onlyStore the BloodHound Enterprise destination URL as configuration instead of a secret when you configure CLI authentication for extension asset uploads.OpenHound now reads the destination URL from ~/.dlt/config.toml and the browser JWT from ~/.dlt/secrets.toml. This change separates the destination URL from sensitive credentials, which remain in the secrets file.
​
Fixed Issues

​
Authentication

SAML replay protection: Resolved an issue where a valid signed SAML response could be replayed to create multiple BloodHound sessions.BloodHound now records both the SAML response ID and assertion ID before creating a session. Any later callback that reuses either identifier is rejected.
Special thanks to Corban Villa, Sohee Kim, and Austin Chu for their detailed report and responsible disclosure.

​
Cypher

  • Resolved an issue where Cypher queries using traversal expansion to find a cyclical loop could fail.
  • Improved query optimization for Cypher queries that begin with an unbounded traversal expansion, reducing avoidable timeouts.
  • Resolved an issue where Cypher query optimization consumed excessive CPU, increasing query durations and causing failures.

​
Explore

  • Resolved an issue where the Cypher panel did not render correctly the first time you switched from a completed pathfinding query.
  • Resolved an issue where selecting a node reset manually positioned graph nodes.

​
OpenGraph

  • Resolved an issue where the Data Quality page could fail to load after you switched domains.
  • Resolved an issue where columns in the OpenGraph Management table could be inaccessible when content wrapped.

​
Findings

Applies to BloodHound Enterprise only
  • Resolved an issue where archived findings could return an active status from the Attack Paths findings API.
  • Resolved an issue where Findings Table filters could fail for environment IDs containing characters such as :.
  • Resolved a Findings Table column-header contrast regression in light and dark modes.
  • Improved tooltip contrast for Attack Paths finding charts in dark mode.
  • Resolved an issue where Findings Table filters overflowed when the navigation panel was expanded.