Short answer (updated October 21, 2026)
Cubite, which runs managed Open edX from $1,260 a month, tracks every Open edX named release and security advisory; as of October 21, 2026, Verawood is the only release with community support.
Named-release upgrades, rehearsed on a UAT environment before production, are included in every Cubite managed Open edX tier. The next named release, Willow, is targeted for late February 2027, according to the Open edX release team.
Newest first. "Code cut" is the day the release branch was cut. "Released" is the date of the release's first tag (its .1 tag from Eucalyptus on); "Unsupported since" is the next release's date, since only the latest release is supported. Dates and tags come from the Open edX named-release branches and tags page, except lilac.3 and maple.3, which it does not list (their dates are the tagged commits'); the Tutor column comes from Tutor's changelog.
| Release | Code cut | Released | Latest tag | Status | Unsupported since | Tutor |
|---|---|---|---|---|---|---|
| Verawood | 2026-04-30 | 2026-07-30 | release/verawood.1 (2026-07-30) | Supported | Still supported | 22 |
| Ulmo | 2025-10-30 | 2026-01-15 | release/ulmo.4 (2026-07-29) | Unsupported | 2026-07-30 | 21 |
| Teak | 2025-04-25 | 2025-06-26 | release/teak.3 (2025-09-18) | Unsupported | 2026-01-15 | 20 |
| Sumac | 2024-10-24 | 2024-12-16 | open-release/sumac.3 (2025-05-16) | Unsupported | 2025-06-26 | 19 |
| Redwood | 2024-05-09 | 2024-06-19 | open-release/redwood.3 (2024-10-23) | Unsupported | 2024-12-16 | 18 |
| Quince | 2023-10-10 | 2023-12-11 | open-release/quince.3 (2024-04-09) | Unsupported | 2024-06-19 | 17 |
| Palm | 2023-04-11 | 2023-06-14 | open-release/palm.4 (2023-11-16) | Unsupported | 2023-12-11 | 16 |
| Olive | 2022-10-11 | 2022-12-12 | open-release/olive.4 (2023-05-22) | Unsupported | 2023-06-14 | 15 |
| Nutmeg | 2022-04-12 | 2022-06-09 | open-release/nutmeg.3 (2022-10-11) | Unsupported | 2022-12-12 | 14 |
| Maple | 2021-10-15 | 2021-12-20 | open-release/maple.3 (2022-04-11) | Unsupported | 2022-06-09 | 13 |
| Lilac | 2021-04-09 | 2021-06-09 | open-release/lilac.3 (2021-11-01) | Unsupported | 2021-12-20 | 12 |
| Koa | 2020-11-12 | 2020-12-09 | open-release/koa.3 (2021-04-07) | Unsupported | 2021-06-09 | 11 |
| Juniper | 2020-05-27 | 2020-06-09 | open-release/juniper.3 (2020-08-25) | Unsupported | 2020-12-09 | 10 |
| Ironwood | 2019-01-17 | 2019-03-21 | open-release/ironwood.2 (2019-06-05) | Unsupported | 2020-06-09 | 3 |
| Hawthorn | 2018-07-03 | 2018-08-07 | open-release/hawthorn.2 (2018-09-26) | Unsupported | 2019-03-21 | Not listed |
| Ginkgo | 2017-07-06 | 2017-08-14 | open-release/ginkgo.2 (2017-12-18) | Unsupported | 2018-08-07 | Not listed |
| Ficus | 2017-01-10 | 2017-02-23 | open-release/ficus.4 (2017-08-10) | Unsupported | 2017-08-14 | Not listed |
| Eucalyptus | 2016-07-13 | 2016-08-26 | open-release/eucalyptus.3 (2017-01-10) | Unsupported | 2017-02-23 | Not listed |
| Dogwood | 2015-12-15 | 2016-02-11 | named-release/dogwood.3 (2016-04-25) | Unsupported | 2016-08-26 | Not listed |
| Cypress | 2015-07-07 | 2015-08-13 | named-release/cypress (2015-08-13) | Unsupported | 2016-02-11 | Not listed |
| Birch | 2015-01-29 | 2015-02-24 | named-release/birch.2 (2015-08-05) | Unsupported | 2015-08-13 | Not listed |
| Aspen | 2014-09-05 | 2014-10-28 | named-release/aspen (2014-10-28) | Unsupported | 2015-02-24 | Not listed |
27 advisories, newest first, from the GitHub security advisories of the openedx repositories. "Affects" lists every release with at least one tag that ships the vulnerable code. "Fixed in" names the oldest release with a tag that carries the fix, or, while no tag carries it, the supported release whose branch does; the description says so. The advisories are the Open edX project's; where GitHub credits a reporter, the credit is on the advisory's page.
| Advisory | Severity | Affects | Fixed in | Published |
|---|---|---|---|---|
| GHSA-c6fp-f54c-6cv4 Forum API lacks permission checks The openedx-forum HTTP API under /forum/api/ answered any caller, even anonymous ones, so anyone could read or delete discussion threads and change a user's username. Fixed on the release/verawood, release/ulmo and release/teak branches and on open-release/sumac.master after their latest tags (openedx-forum 0.4.2.post1 on Verawood, 0.4.1.post1 on Ulmo and Teak, 0.2.1 on Sumac); no tagged release carries the fix yet, so run the release-branch head or upgrade the package. Package: openedx-forum | Critical | Sumac to Verawood | Verawood | 2026-10-14 |
| GHSA-hm6j-7x8q-5hqw Aspects guest token retrievable by any logged-in user Only sites running Aspects are affected: any signed-in LMS user could request a Superset guest token and read Aspects dashboard data, possibly including personal information. The advisory lists a patched platform-plugin-aspects for each release from Redwood to Verawood, with upgrade steps. Package: platform-plugin-aspects | High | Redwood to Verawood | a patched platform-plugin-aspects | 2026-10-02 |
| GHSA-c6xg-fh3c-vvhh Unrestricted image upload leads to stored XSS attack Studio accepts HTML files disguised as images, so a course staff member can plant stored XSS that runs as a course admin. Fixed on the release/verawood and release/ulmo branches after the verawood.1 and ulmo.4 tags (commits b5fc56a101 and 2efdce0760); no tagged release carries the fix yet, so run the release-branch head or apply the patch. Package: openedx-platform | Critical | Aspen to Verawood | Verawood | 2026-09-15 |
| GHSA-g266-6v7f-j465 DoS vulnerability in video download API allows resource exhaustion The Studio video download API fetches every URL in the request with no timeout, size cap or count limit, so a course author can exhaust the workers. Fixed on the release/verawood and release/ulmo branches after the verawood.1 and ulmo.4 tags (commits f657d158c2 and c99de016f1); no tagged release carries the fix yet. Package: openedx-platform | Moderate | Redwood to Verawood | Verawood | 2026-08-05 |
| GHSA-95xv-3c54-c3pwCVE-2026-97702 Support course-team API skips the support-permission check The support "manage_course_team" REST API lacks the support-permission check its sibling support views enforce, so any signed-in user can look up accounts and see other users' staff and instructor roles. Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | Moderate | Ulmo | Ulmo | 2026-07-29 |
| GHSA-6cmm-8875-5pcwCVE-2026-85272 Path traversal via prefix-bypass in safe_extractall Path Validation Path traversal via prefix-bypass in safe_extractall Path Validation. Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | Moderate | Aspen to Ulmo | Ulmo | 2026-07-17 |
| GHSA-rv5w-f4r5-h77gCVE-2026-85271 Stored CSS injection in email digests via unsanitized thread titles Discussion thread titles reach email digest notifications unsanitized, so a learner can inject CSS into emails other users receive (an incomplete patch of GHSA-4xv3-5j4x-q8g4). Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | Moderate | Redwood to Ulmo | Ulmo | 2026-07-17 |
| GHSA-mj74-gfq3-2v9f Vendored pdf.js library Contains a remote Code Execution Vulnerability Vendored pdf.js library Contains a remote Code Execution Vulnerability. Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | High | Aspen to Ulmo | Ulmo | 2026-07-07 |
| GHSA-fpf9-9rpr-jvrxCVE-2026-55421 SSRF in Studio Video Download Endpoint SSRF in Studio Video Download Endpoint. Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | Moderate | Redwood to Ulmo | Ulmo | 2026-06-12 |
| GHSA-6gm5-c49g-p3h9CVE-2026-53636 Open edX LTI OAuth Replay Attack Open edX LTI OAuth Replay Attack. Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | Moderate | Cypress to Ulmo | Ulmo | 2026-06-04 |
| GHSA-rqq6-w4pv-7pjvCVE-2026-53635 Insufficient Permission on set_course_mode_price() Insufficient Permission on set_course_mode_price(). Fixed in the ulmo.4 (2026-07-29) and verawood.1 (2026-07-30) tags. Package: openedx-platform | High | Aspen to Ulmo | Ulmo | 2026-06-01 |
| GHSA-328g-7h4g-r2m9CVE-2026-42858 SSRF in SAML provider data sync endpoint The SAMLProviderDataViewSet.sync_provider_data endpoint fetches SAML metadata URLs without restricting their scheme/host, allowing server-side request forgery against internal infrastructure. Package: openedx-platform | High | Nutmeg to Ulmo | Ulmo | 2026-04-24 |
| GHSA-4xv3-5j4x-q8g4CVE-2026-42857 Stored CSS injection in email notifications Incomplete HTML sanitization in email notification rendering allows attacker-controlled CSS to persist, enabling visual phishing within trusted Open edX emails. Fixed in the ulmo.3 tag (2026-04-30) and in Verawood. Package: openedx-platform | Moderate | Sumac to Ulmo | Ulmo | 2026-04-24 |
| GHSA-64cv-vxpr-j6vcCVE-2026-42860 edx-enterprise SSRF via SAML metadata URL Companion SSRF in edx-enterprise's sync_provider_data endpoint, in edx-enterprise 7.0.2 to 7.0.4 only and fixed in 7.0.5; no named release pins an affected version (Ulmo pins 6.5.1, Verawood 8.0.2). Package: edx-enterprise | High | No named release | edx-enterprise 7.0.5 | 2026-04-24 |
| GHSA-2843-x998-f8r2CVE-2026-35404 Open redirect in Survey views via unvalidated redirect_url The survey app accepts an unvalidated redirect_url parameter, enabling phishing attacks that bounce users off a trusted Open edX domain. Package: openedx-platform | Moderate | Birch to Ulmo | Ulmo | 2026-04-02 |
| GHSA-m6rg-rp98-4crwCVE-2026-34736 Account activation bypass via activation_key exposure in REST API A REST endpoint inadvertently exposes activation_key values, allowing an attacker to confirm accounts they should not have access to. Fixed in the ulmo.3 tag (2026-04-30) and in Verawood. Package: openedx-platform | Moderate | Nutmeg to Ulmo | Ulmo | 2026-03-30 |
| GHSA-rh64-vc2h-7wfjCVE-2025-68270 CourseLimitedStaff role allows Studio access Users with the limited course-staff role can access Studio endpoints they should not be able to reach, enabling unauthorized course modification. Package: openedx-platform | Critical | Quince to Teak | Ulmo | 2025-12-16 |
| GHSA-x5cm-2hpq-pw57CVE-2025-47942 Learners can download python_lib.zip Course-bundled python_lib.zip is downloadable by learners, and it often holds custom grading code or the answers to course problems. Fixed in the teak.1 and ulmo.1 tags; the Sumac fix is on open-release/sumac.master after sumac.3. Package: openedx-platform | Moderate | Birch to Sumac | Teak | 2025-05-21 |
| GHSA-fg8c-2pvj-wx3jCVE-2024-43782 Atlas translations for Open edX missing validation Translations that Redwood pulls from the openedx-translations repository with openedx-atlas were not checked for malformed strings and script injection, as edx-platform's own translations had been. The fix is in the openedx-translations repository (August 2024), and its maintainers found no exploited strings. Package: openedx-translations | High | Redwood | the openedx-translations repository | 2024-08-23 |
| GHSA-4528-7fh6-x75cCVE-2024-41806 Instructor cohort-creation CSV upload not Private by Default With some storage backends, the cohort CSV files instructors upload, which list learners, could be publicly readable; the fix writes them to S3 with a private ACL. Fixed in the redwood.2 tag. Package: openedx-platform | Moderate | Juniper to Redwood | Redwood | 2024-07-25 |
| GHSA-7pvm-qc65-fhcv Course Creators can create content libraries for unauthorized Orgs Course-creator role can create content libraries under organizations they do not belong to, enabling cross-org content placement. Fixed in the redwood.2 tag. Package: openedx-platform | Moderate | Palm to Redwood | Quince | 2024-07-25 |
| GHSA-cq7m-mhqc-jrx6 Limited Course Staff can access Studio APIs The limited course-staff role gains unintended access to Studio APIs that should require full course-staff permissions. The regression and its fix both first shipped in redwood.1, so no named release's tags carry the vulnerable code. Package: openedx-platform | High | No named release | Redwood | 2024-06-17 |
| GHSA-99vw-2wrq-xh9x Privilege re-escalation in Studio after staff access removed Studio updated the user record from the claims in a still-valid JWT, so a user whose global staff flag an administrator removed could get it back by presenting an older token. Package: openedx-platform | High | Maple to Quince | Redwood | 2024-05-17 |
| GHSA-qx8m-mqx3-j9fmCVE-2024-22209 XBlock custom auth does not respect JWT scopes The XBlock custom authentication backend ignores JWT scope claims, allowing tokens with narrow scope to access broader endpoints. Fixed in the quince.2 tag; the Palm fix is on open-release/palm.master after palm.4. Package: openedx-platform | Moderate | Ironwood to Quince | Quince | 2024-01-12 |
| GHSA-3q74-3rfh-g37j Unprivileged users can create content libraries in Studio A missing authorization check allows any authenticated user to create content libraries in Studio, regardless of role. Fixed in the palm.2 tag. Package: openedx-platform | Critical | Nutmeg to Palm | Palm | 2023-07-25 |
| GHSA-7j9p-67mm-5g87CVE-2023-23611 lti-consumer-xblock LTI 1.3 grade pass-back missing authorization The LTI 1.3 consumer XBlock did not authorize grade pass-back requests, so a malicious tool provider could overwrite grades. It affects lti-consumer-xblock 7.0.0 to 7.2.1 and is fixed in 7.2.2; no named release pinned an affected version (Olive pins 4.5, Palm 8.0.1). Package: lti-consumer-xblock | Low | No named release | lti-consumer-xblock 7.2.2 | 2023-01-24 |
| GHSA-qv6c-367r-3w6qCVE-2022-46147 xblock-drag-and-drop-v2 stored XSS Stored cross-site scripting in the drag-and-drop XBlock allows an attacker with course-author access to inject script that executes for learners. Package: xblock-drag-and-drop-v2 | High | Eucalyptus to Nutmeg | Olive | 2022-11-28 |
These fixes are on the release branch but in no tag yet: a site on the latest tag lacks them until it runs the branch head or applies the patch.
release/verawood.1release/ulmo.4release/teak.3open-release/sumac.3open-release/quince.3open-release/palm.4As of October 21, 2026, Verawood is the only release with community support. Every earlier named release is unsupported, so it gets no community security fixes in a tagged release.
The next named release, Willow, is targeted for late February 2027. The Open edX Build-Test-Release working group moved the Willow cut to early January 2027 because the Verawood cycle ran late and several features are still in development, and confirmed the plan on the Open edX forum on October 5, 2026.
No. Ulmo lost community support when Verawood shipped on July 30, 2026. The August, September and October 2026 security fixes still reached the release/ulmo branch after ulmo.4, without a new tag, but do not plan around that continuing.
Find your release in the advisories table on this page, or run Cubite's free release checker, which reads the same data and lists the advisories and the upgrade path for your release.
Yes. Named-release upgrades, rehearsed on a UAT environment before production, are included in every Cubite managed Open edX tier, from $1,260 a month. Bringing an inherited instance up from an unsupported release is a fixed quote agreed before the managed term starts.
Release dates and support status come from the Open edX named-release branches and tags page on docs.openedx.org, Tutor versions from Tutor's changelog, advisories from the GitHub security advisories of the openedx repositories, and release plans and cut dates from the Open edX forum. Cubite reviews the data weekly.
Check your release in the free checker, or book a 30-minute call about getting to Verawood. Cubite runs managed Open edX from $1,260 a month with named-release upgrades included; bringing an inherited instance up from an unsupported release is a fixed quote agreed before the managed term starts.