This change log is closed and will not receive any further additions. For all future releases and deploys, refer to the release & deploy notes.
This Change Log reflects precautionary UX changes made by Instructure in response to the May 2026 Security Incident. Updates will be added as they are made available.
Canvas LMS
Admin Settings
Announcement Date: 2026-05-09
Beta and Production Availability: 2026-05-03
- A setting designates an Elevated Auth Provider for Instructure employees. When enabled, Instructure’s actions require the user to be authenticated through the selected provider. Requests from users authenticated through any other provider will fail.
This change impacts Instructure employees. The setting is configured by Instructure engineers and is not currently available to Canvas administrators.
Announcement Date: 2026-05-09
Beta and Production Availability: 2026-05-06
- When the Elevated Auth Provider is enabled on an account, a user must be authenticated via that provider to change settings on the Theme Editor admin settings page.
- When the Elevated Auth Provider is enabled on an account, a user must be authenticated via that provider to change settings on the Content Security Policy (CSP) admin settings page.
These changes impact Instructure employees. The settings are configured by Instructure engineers and is not currently available to Canvas administrators.
Announcement Date: 2026-05-10
Beta Availability: 2026-05-09
Production Availability: 2026-05-10
- API key secrets are no longer visible in the UI after creation. Admins can regenerate keys at any time without deleting and recreating the API.
API
Announcement Date: 2026-05-08
Beta and Production Availability: 2026-05-06
- The GraphQL Enrollments API only returns Enrollment IDs for the invoking user. Previously a user with permission to view enrollments in a course could see all Enrollment IDs in the course.
Announcement Date: 2026-05-11
Beta and Production Availability: 2026-05-11
- Integrations using the
urn:ietf:wg:oauth:2.0:oob redirect URI in the OAuth flow must now explicitly add it to the list of allowed redirect URIs on their developer key. This has already been done for the most common shared integrations, but schools should check whether any of their own integrations rely on it.- Action required: Add the referenced URI to any relevant developer keys
/accounts/self/developer_keys. Usage of this redirect URI is also being actively monitored, and the URI will be proactively added to customer developer keys when use is detected.
Announcement Date: 2026-05-19
Beta Availability: 2026-05-18
Production Availability: 2026-05-20
Announcement Date: 2026-05-29
Beta and Production Availability: 2026-05-29
Data Access Platform API keys generated through Identity Services at identity.instructure.com requires email verification before activation. After creating a key, the admin receives a six-digit verification code at the email address associated with their Canvas account. The key remains in a pending_verification state until the verification code is entered.
Verification Requirements
- Verification codes are valid for five minutes.
- Admins can resend the code up to three times.
- Up to five incorrect verification attempts are allowed per key.
- Verification must be completed within 15 minutes of key creation.
- Keys that are not verified within 15 minutes are permanently locked.
Partner Keys
For partner keys, the partner one-time password email is not sent until admin verification is successfully completed.
Impact
- Existing Data Access Platform API keys continue to function without changes.
- Canvas Developer Keys created directly within Canvas are not affected.
Authentication
Announcement Date: 2026-05-12
Beta and Production Availability: 2026-05-12
- The native Canvas authentication (username + password) supports resetting passwords for individual users in the root account’s People page. Previously, admins would navigate to the individual user’s profile page and click the Reset Password button. The Authentication page also has a Reset All Passwords button which resets the user password for all users using that authentication method. Bulk resets are processed in the background, meaning it may take several minutes for all reset notifications to be sent to users but you may navigate away from the page after the process has started. When a user logins in after the reset, they will be prompted to change their password.
Announcement Date: 2026-05-13
Beta and Production Availability: 2026-05-13
- For customers using native Canvas authentication (username + password), admins can enable multi-factor authentication from the Account Settings page. Once the Multi-Factor Authentication setting is enabled, MFA options will display on the Authentication page. The Multi-Factor Authentication setting provides the following options:
Developer Keys
Announcement Date: 2026-05-09
Beta and Production Availability: 2026-05-09
- Developer key management is now gated on elevated auth for Instructure employees. Instructure employees managing developer keys in customer accounts must authenticate through the account’s designated Elevated Auth Provider.
This change impacts Instructure employees. The setting is configured by Instructure engineers and is not currently available to Canvas administrators.
Files
Announcement Date: 2026-05-20
Beta Availability: 2026-05-21
Production Availability: 2026-06-03
- HTML files uploaded directly to Canvas Files are downloaded instead of previewed in-app. This impacts users who upload HTML-based course content or resources to Files for others to access and review.
LTI OAuth
Announcement Date: 2026-05-09
Beta and Production Availability: 2026-05-08
- OAuth workflows can only be completed through user navigation. Some institutions previously used custom JavaScript to automate user permission acceptance during LTI launch. Permissions now must be approved by the user navigating the page directly.
Rich Content Editor
Announcement Date: 2026-07-10
Beta Availability: May 2026
Production Availability: 2026-06-03
- The Rich Content Editor is updated to improve Canvas security. Some HTML tags are no longer allowed. To find the current list of approved tags, view the updated Canvas HTML Editor Allowlist.
Announcement Date: 2026-05-08
Production Availability: 2026-04-30
- The list of permitted attributes for
object and embed elements in the RCE has been updated. If a user edits a page that includes a non-standard embed, any unsupported attributes will be removed when the page is saved.
Announcement Date: 2026-05-08
Beta and Production Availability: 2026-05-08
- The raw HTML input and pretty HTML input methods have been removed from the RCE. The default WYSIWYG interface is still available. Known Issue: HTML editor button missing from RCE.
Announcement Date: 2026-05-08
Beta and Production Availability: 2026-05-08
- The raw HTML input and pretty HTML input methods have been added back to the RCE. The default WYSIWYG interface is still available.
Rubrics
Announcement Date: 2026-07-10
Beta Availability: May 2026
Production Availability: 2026-06-03
- Support for certain special characters in rubrics was removed. Rubrics containing special characters may not retain formatting and IDs may be deleted through Common Cartridge import or Blueprint sync.
Announcement Date: 2026-07-10
Beta Availability: June 2026
Production Availability: 2026-06-21
- Support for certain special characters in rubrics was reinstated for plain text fields and will no longer cause formatting issues during Common Cartridge import or Blueprint sync. If there are rubrics that were edited, imported, or synced in between June 3 and June 21 and have issues with formatting, manually open and save the rubric to correct the text.
User Self-Registration
Announcement Date: 2026-05-09
Beta and Production Availability: 2026-05-08
- Self-registration is now disabled by default across all customer instances. The setting can be re-enabled.
Legacy Impact
Announcement Date: 2026-05-08
Production Availability: 2026-05-07
- Custom scripting for messages, walkthroughs, and support articles via the 'Edit Custom Script' editor have been removed. This change was already planned and customers were notified that it was coming in April 2025.
Announcement Date: 2026-05-09
Production Availability: 2026-05-08
- Iframes, scripts, and embedded videos within new articles, messages, and walkthroughs are no longer available. Content that has already been published will remain unaffected.
