F5 Insight 1.2.3 release notes¶
Important
This is a critical release. See Overview of F5 Critical Releases for more information and treat every release as though it closes a critical gap.
The following table summarizes the impact of Critical and High severity vulnerabilities in the data plane across the F5 product portfolio.
| Product | Critical | High |
|---|---|---|
| F5 Distributed Cloud Services | No | No |
| BIG-IP TMOS | Yes | Yes |
| BIG-IP Access Policy Manager (APM) Clients | No | Yes |
| BIG-IP SSL Orchestrator | Yes | Yes |
| F5OS - Appliance | Yes | Yes |
| F5OS - Chassis | Yes | Yes |
| BIG-IQ | Yes | Yes |
| F5 Insight | Yes | Yes |
| BIG-IP Next for Kubernetes | Yes | Yes |
| F5 BIG-IP Cloud-Native Network Functions (CNFs) | Yes | Yes |
| BIG-IP Next for Kubernetes (Host) | Yes | Yes |
| BIG-IP eBPF Observability (EOB) | No | No |
| BIG-IP Container Ingress Services (CIS) | No | No |
| Aspen Mesh | No | No |
| F5 NGINX Plus | No | Yes |
Release notes for F5 Insight 1.2.3, the on-premises observability and operational strategy solution for F5 Application Delivery and Security Platform.
Version 1.2.3 | October 2026
| Product | F5 Insight |
| Version | 1.2.3 |
| Release date | October 2026 |
| Deployment model | On-premises / self-hosted |
| Document revision | 1.2.3 |
About this release¶
F5 Insight 1.2.3 is a critical release that addresses security updates and critical vulnerability fixes (CVEs). F5 strongly recommends that you upgrade to this version to maintain system security and integrity.
System requirements¶
Host platform¶
| Component | Requirement |
|---|---|
| Operating system | F5-supported image |
| Architecture | x86_64 (AMD64) |
| CPU | Minimum 12 vCPUs |
| Memory | Minimum 16 GB RAM |
| Storage | 650 GB overall single volume storage. 100 GB for OS; 50 GB for backup and restore; 500 GB minimum for default telemetry retention policy |
| Hypervisor images | QCOW and OVA |
Managed BIG-IP devices¶
| Component | Requirement |
|---|---|
| BIG-IP version | 17.5.x |
| Modules | Local Traffic Manager (LTM) required; DNS, Advanced Web Application Firewall (AWAF), Advanced Firewall Manager (AFM), Access Policy Manager (APM), Carrier-Grade NAT (CGNAT), and SSL Orchestrator (SSLO) supported |
| Management access | iControl REST API enabled; HTTPS reachable from F5 Insight host |
| Telemetry iRule | High-speed logging (HSL) enabled; syslog reachable from collector listener |
Fixed issues¶
This section details the bugs and issues resolved in this release.
Upgrade or rollback can fail if the appliance reboots during the Helm install phase
Previously, if an unexpected reboot occurred while an upgrade was applying the new software (the Helm install/upgrade phase), the automatic rollback could itself fail. This left the appliance in a partially upgraded, inconsistent state that required manual intervention or a VM snapshot restore to recover.
Now, the upgrade and rollback process is more resilient to unexpected reboots during the Helm install phase. If this situation occurs, the appliance automatically recovers the application deployment to a known-good state. Upgrade recovery after an interruption is also faster and more reliable.
F5 Insight support bundle collection of /var/log might be interrupted by journal file change
Previously, support bundle collection on an active production system might collect only a partial
/var/logdirectory. The collection script treatedtarexit code 1 as a fatal error, even though this code is commonly returned as a non-fatal warning when log files change while being archived. As a result, the script fell back to partial collection and could omit important logs, including rotated journald (.journal) files.Now, the collection script correctly handles
tarexit code 1 as a non-fatal warning. Support bundles generated on active production systems include the complete/var/logdirectory, including actively written logs and rotated journald files.Preview checks report false disk space errors on BIG-IP i15k DF devices with MD-type volumes
Previously, preview checks incorrectly reported insufficient disk space errors on BIG-IP i15k DF devices that use MD-type volumes, even though sufficient space was available. The installation completed successfully when performed manually.
Now, preview checks correctly calculate available disk space on BIG-IP i15k DF devices with MD-type volumes.
This issue occurs with both target volume options:
- Sequential new volume: The preview check returns an error similar to:
insufficient VG free space for new volume "MD1.3". 0.00 GB available 15 GB required - delete an unused volume slot to reclaim space before creating a new one. - Existing volume: The preview check returns an error similar to:
VG free space 0.00 GB is below the 2 GB recommended buffer for in-place upgrade of "MD1.1" - the upgrade may fail if VM needs to expand existing logical volume.
- Sequential new volume: The preview check returns an error similar to:
Software upgrade status might report as complete before the second reboot on iSeries DF devices
Previously, when you performed a software installation on an iSeries DF device, F5 Insight intermittently marked the upgrade as complete after the first reboot, while the upgrade was still in progress. iSeries DF devices reboot twice during an upgrade.
Now, F5 Insight correctly waits for the second reboot to complete before marking the upgrade as finished.
Known issues¶
SAML single logout (SLO)
SAML Single Logout (SLO) is a known limitation in this release. Logging out of F5 Insight might terminate your F5 Insight session, while the Identity Provider (IdP) session can stay active, allowing re-login without re-authentication.
Workaround: To make sure you fully log out, do one of the following:
- Use a private or incognito browser window for SAML sessions.
- Explicitly log out from the IdP after logging out of F5 Insight.
IdP group sync
When user group or profile attributes are changed in an external IdP (SAML/OIDC, for example, Okta or Ping), those updates might not be synchronized to the existing user record in F5 Insight on subsequent logins. As a result, previously assigned groups in F5 Insight can persist (for example, admin group remains after change to operator group in IdP).
Workaround: Re-create the SAML IdP provider configuration in F5 Insight after IdP group changes are made.
Manual browser refresh required after upgrading from 1.1.x to 1.2.3
After upgrading from F5 Insight version 1.1.x to 1.2.3, the user interface might not automatically refresh to reflect the updated interface. This occurs because the auto-reload fix delivered in 1.2.3 only applies to upgrades starting from version 1.2.0 onwards due to significant codebase restructuring between 1.1.x and 1.2.0.
Workaround: After upgrading from 1.1.x to 1.2.3, perform a manual browser refresh to load the updated 1.2.3 user interface.
LDAP + StartTLS isn’t functional with a custom CA certificate
Runtime LDAP login fails when the identity provider is configured for LDAP with StartTLS and a custom CA certificate. Backend certificate validation accepts the custom CA, but the current identity management component doesn’t apply it during a StartTLS login attempt.
Workaround: Use LDAPS instead of LDAP + StartTLS for custom CA deployments. If your environment requires StartTLS, apply the workaround script described in Workaround: apply a custom CA for StartTLS.
External authentication with Active Directory can only assign a user to a Viewer role
This is a known limitation in this release. F5 Insight’s LDAP group search currently requires groups to exist under
ou=groups,<baseDN>. Directories that don’t use this layout, including Active Directory, resolve no groups, and affected users default to the Viewer role. This issue is scheduled for a fix in a future release of F5 Insight.Workaround: None. This issue is scheduled for a fix in a future release.
Disk space check might report inaccurate results for F5OS appliances upgraded from version 1.5.2 or earlier
The disk space check in F5 Insight might report inaccurate results for F5OS appliances that were upgraded from version 1.5.2 or earlier, which can cause upgrade failures.
Workaround: Make sure that the available disk space is greater than 60% before you start an upgrade on devices previously upgraded from F5OS 1.5.2 or earlier releases.
Large-scale concurrent distribution and installation jobs fail on BIG-IP version 21.1.0
Running large-scale concurrent distribution and installation jobs on BIG-IP version 21.1.0 can cause timeout and resource contention issues, resulting in:
- Intermittent distribution failures across parallel batches.
- Installation failures when the new boot volume doesn’t become active within the expected timeframe.
Workaround: Reduce the number of concurrent distribution and installation jobs, or run them in smaller batches. This issue is scheduled for a fix in F5 Insight future releases.
HA software installation execution drawer doesn’t reflect paused state during subsequent HITL pause
During an HA software installation job configured with multiple Human-in-the-Loop (HITL) pause gates, if you resume the job after an initial pause and keep the execution details drawer open, the drawer UI doesn’t automatically update when subsequent HITL pauses (such as the failover gate) are reached. The drawer remains stuck showing “Executing” with a Pause button instead of displaying the paused banner and Resume button.
Condition: This issue occurs when all of the following are true:
- An HA Software Installation job is running with multiple HITL pause gates enabled (for example,
hitlPauseAfterStandbyInstallBeforeRebootandhitlPauseAfterStandbyRebootBeforeFailover). - You resume the execution from the initial pause and keep the execution details drawer open continuously while the node reboots and reaches a subsequent pause gate.
Impact: The drawer appears to remain actively executing and doesn’t surface the Resume button or the paused banner. You can’t resume the next phase of installation from the open drawer without refreshing the view.
Workaround: Close the execution details drawer, return to the Jobs list page, and reopen the execution details drawer. The drawer immediately refreshes and displays the paused status along with the Resume button.
- An HA Software Installation job is running with multiple HITL pause gates enabled (for example,
Provisioning and system-manager retain stale Vault client certificate after rotation
Provisioning and other operations that require securely stored credentials might fail after an internal authentication certificate expires, even when a replacement certificate has been generated. Affected services continue using the previous certificate until you restart them.
Possible errors include:
device credentials unavailable - cannot check BIG-IP disk spaceVault is unavailable. Cannot securely store password.
Condition: Affected services remain running through automatic certificate rotation and attempt operations after their previously loaded certificate expires.
Impact: Device provisioning, saving or accessing SMB storage credentials, scheduled backups, and online software downloads might fail.
Workaround: Restart the affected pods from the CLI.
Restart the provisioning pod:
sudo kubectl rollout restart deployment/provisioning -n f5-insight
Verify the provisioning pod status:
sudo kubectl rollout status deployment/provisioning -n f5-insight
Restart the system-manager pod:
sudo kubectl rollout restart deployment/system-manager -n f5-insight
Verify the system-manager pod status:
sudo kubectl rollout status deployment/system-manager -n f5-insight