> This page is for Itential Gateway, version 5 (default).
> For other versions, use one of these documentation indexes:
> - 5 (default): https://docs.itential.com/itential-gateway/5/llms.txt
> - 4: https://docs.itential.com/itential-gateway/4/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Gateway 5.5.4

Itential Gateway 5.5.4 is a maintenance release containing one enhancement, one bug fix, and one security fix.

#### Enhancements (1)

| Issue                                                       | Description                                                                                                                                                                                                                                                                                                                                                                                |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Custom installation directories for the RPM** (ENG-28763) | Added support for installing the Gateway 5 RPM to custom directories, such as `/apps`, with `rpm --relocate`. You can relocate each of the four directories independently: `/opt/gateway`, `/etc/gateway`, `/var/log/gateway`, and `/var/lib/gateway`. When you upgrade a relocated installation, repeat the same `--relocate` flags. Otherwise, the upgrade reverts to the default paths. |

#### Bug fixes (1)

| Issue                                                                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Secret references in Basic authentication headers not resolved** (ENG-32510) | Fixed an issue where Gateway didn't resolve `$GATEWAYSECRET_(...)` secret references in Basic authentication headers that were base64-encoded before they reached Gateway. The target system received the literal placeholders as credentials. Gateway now decodes Basic `Authorization` and `Proxy-Authorization` headers, resolves the secret references in the username and password, and re-encodes the header before it sends the request. Headers without secret references are forwarded unchanged. |

#### Security fixes (1)

| Issue                                                      | Description                                                                                                                                                                                                             |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Updated Go and golang.org/x/net** (ENG-30748, ENG-30747) | Updated Go to 1.26.10 and `golang.org/x/net` to v0.60.0 to resolve 12 vulnerabilities in the Go standard library and networking packages, including CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, and CVE-2026-78669. |