Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Keycloak26.8.1SecurityTodayOct 13, 2026

ACTION 7CHECK 21OTHER 19View full analysis

A security-focused maintenance release with vulnerability fixes across authentication, administration, identity brokering, authorization, token exchange, and observability. It also updates vulnerable jackson-databind and simple-git dependencies and includes further corrections in clustering, organizations, token handling, and HTTP processing.

Action needed (7)

securityhighCVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependency
The com.fasterxml.jackson.core:jackson-databind dependency was updated for CVE-2026-91777.
securitymediumCVE-2026-94001 admin credential deletion authorization
This release fixes CVE-2026-94001, which allowed an admin credential deletion to bypass denied reset-password permission in admin fine-grained permissions.
securitymediumCVE-2026-94215 cross-realm resource access
This release fixes CVE-2026-94215, which enabled cross-realm realm resource read and write through the per-request session-level cache in RealmCacheSession.
securitymediumCVE-2026-97177 user-update authorization
This release fixes CVE-2026-97177, which allowed a generic user update to bypass denied reset-password permission.
securitytools.jackson.core:jackson-databind dependency updates
The tools.jackson.core:jackson-databind dependency was updated for multiple CVEs.
securitysimple-git dependency updates
The simple-git dependency was updated for multiple CVEs.
securityUsername enumeration through empty-password timing
This release fixes username enumeration through empty-password timing in authentication.

Check if affected (21)

securitymediumCVE-2026-15943 identity provider client-secret reuse
Applies if you use OIDC identity provider and configure token URL.
securitymediumCVE-2026-82968 identity-provider account linking
Applies if you use null or GitHub identity provider.
securitymediumCVE-2026-94000 delegated-admin role escalation
Applicability is not stated in the release notes.
+ 18 more on the release page

Envoyv1.39.4Networking & MessagingYesterdayOct 12, 2026

OTHER 7View full analysis

A maintenance release fixes concurrency races in route and shared configuration handling. It also corrects Prometheus native histogram bucket indices; no operator configuration changes are stated.

Strimzi1.3.0Networking & MessagingYesterdayOct 12, 2026

ACTION 4CHECK 1PLAN 1OTHER 7View full analysis

A behavior-changing release tightens Kubernetes and CRD requirements, changes feature-gate defaults, and removes Kaniko from Connect image builds. It also adds early-access cluster security and cert-manager integrations, newer Kafka and HTTP Bridge support, service-account token mounts, and dashboard updates; no security fixes are disclosed.

Action needed (4)

breakingThe Kaniko build tool, removed
Kaniko is removed, and Buildah is the only tool used for building Connect images.
breakingThe UseConnectBuildWithBuildah feature gate, enforced by default
The UseConnectBuildWithBuildah feature gate moves to GA and is enabled by default without an option to disable it.
breakingThe UseBackgroundPodDeletion feature gate, enabled by default
The UseBackgroundPodDeletion feature gate moves to beta and is enabled by default. It can still be disabled in the Cluster Operator feature-gates configuration.
breakingKubernetes version support, limited to 1.32 and newer
From Strimzi 1.3.0, only Kubernetes 1.32 and newer are supported. Kubernetes 1.30 and 1.31 are no longer supported.

Check if affected (1)

breakingOlder CRD APIs removed
Applies if you use v1beta2, v1beta1, or v1alpha1 for custom resources or CRDs.

Plan ahead (1)

deprecatedPKCS12 certificate generation, deprecatedremoval date not announced
Applies if you use PKCS12 format certificates.

Envoyv1.38.7Networking & MessagingYesterdayOct 12, 2026

ACTION 1OTHER 5View full analysis

A maintenance release with a disclosed security dependency update and fixes for concurrency and metrics correctness. No operator configuration changes are announced.

Action needed (1)

securitylowwasmtime update for CVE-2026-54786
Wasm support updates the wasmtime dependency to 24.0.10 to resolve CVE-2026-54786.

Envoyv1.37.9Networking & MessagingYesterdayOct 12, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with a disclosed security dependency update and fixes for concurrency bugs. It contains no announced operator configuration changes.

Action needed (1)

securitylowThe wasmtime dependency update for CVE-2026-54786
The wasmtime dependency was updated to 24.0.10 to resolve CVE-2026-54786.

Envoyv1.36.13Networking & MessagingYesterdayOct 12, 2026

ACTION 1OTHER 3View full analysis

A security maintenance release updates Wasmtime and fixes several race conditions in AWS request signing, AWS Lambda, local rate limiting, and secret distribution. It introduces no newly enforced configuration or behavioral requirements.

Action needed (1)

securitylowThe wasmtime dependency update for CVE-2026-54786
wasmtime was updated to 24.0.10 to resolve CVE-2026-54786.

KubeVirtv1.9.1Orchestration & ManagementYesterdayOct 12, 2026

OTHER 19View full analysis

A maintenance release focused on correctness fixes and dependency updates. It includes fixes across guest behavior, storage, migration, hardware handling, and deployment configuration, with no disclosed security changes.

Open Policy Agent (OPA)v1.21.2SecurityYesterdayOct 12, 2026

OTHER 2View full analysis

A maintenance release with updated Go and networking dependencies and security advisory pointers. It also corrects encoded-slash handling in basic authorization policy input and the Data API.

Argov3.5.5CI/CD & App DeliveryYesterdayOct 12, 2026

OTHER 14View full analysis

A maintenance release with correctness fixes and dependency updates. It does not intentionally change operator setup or security behavior.

Argov3.3.16CI/CD & App DeliveryYesterdayOct 12, 2026

OTHER 6View full analysis

A maintenance release focused on bug fixes and dependency updates, with no stated changes requiring operator reconfiguration.

Argov3.4.11CI/CD & App DeliveryYesterdayOct 12, 2026

OTHER 10View full analysis

A maintenance release focused on correctness fixes and dependency updates. No operator-facing configuration or compatibility changes are called out.

Mesheryv1.0.71Provisioning & RuntimeOct 11, 2026

ACTION 1CHECK 1OTHER 12View full analysis

A maintenance release removes an adapter and corrects server, CLI, and UI behavior. No security changes are disclosed.

Action needed (1)

breakingDuplicate View Connection link in the connection creation toast, removed
The UI removes the duplicate View Connection link from the connection creation toast.

Check if affected (1)

breakingThe NGINX Service Mesh adapter, removed
Applies if you use the NGINX Service Mesh adapter.

Daprv1.18.7Orchestration & ManagementOct 9, 2026

OTHER 14View full analysis

A maintenance release focused on correctness, with fixes for sidecar crashes, data races, resource leaks, request mix-ups, and excessive logging. It does not introduce operator-facing configuration changes.

NATSv2.15.1Networking & MessagingOct 9, 2026

CHECK 5OTHER 60View full analysis

A maintenance release focused on correctness and performance, with a legacy gateway behavior removed and new limits and validations that may affect existing configurations. It also includes fixes across authentication, account and subscription handling, configuration reloads, clustering, storage, consumers, and client operations.

Check if affected (5)

securityauth_users auth callout bypass issues corrected
Applies if you configure auth_users.
breakingThe max_ha_assets limit, enforced consistently
Applies if you configure max_ha_assets.
breakingThe legacy $GR. reply prefix, removed
Applies if you use the legacy $GR. reply prefix.
+ 2 more on the release page

NATSv2.14.8Networking & MessagingOct 9, 2026

ACTION 1CHECK 2OTHER 53View full analysis

A maintenance release focused on correctness and performance. It removes a legacy gateway capability and tightens related ingress behavior, alongside fixes across authentication, configuration, routing, and stream handling.

Action needed (1)

breakingThe legacy $GR. reply prefix reserved on client ingress
The legacy $GR. reply prefix is now reserved on client ingress. Clients can no longer publish to gateway reply subjects using that prefix.

Check if affected (2)

breakingRemoval of the legacy $GR. reply prefix
Applies if you use servers prior to v2.1.2.
breakingRemote proxy option validation
Applies if you configure remote proxy options and do not specify a proxy URL.

Harborv2.15.4Storage & DataOct 9, 2026

CHECK 3OTHER 3View full analysis

A patch release that restores private-network webhook behavior by default and changes legacy signer handling. It also updates the bundled Trivy, Trivy adapter, and Distribution components, with no disclosed security changes.

Check if affected (3)

breakingLegacy signer pull behavior
Applicability is not stated in the release notes.
breakingThe HARBOR_ALLOW_PRIVATE_NETWORK_ACCESS default
Applies if you do not configure allow_private_network_access.
breakingThe allow_private_network_access migration default
Applies if you do not configure allow_private_network_access.

Daprv1.18.5Orchestration & ManagementOct 8, 2026

OTHER 31View full analysis

A corrective maintenance release focused on workflow reliability, scheduler stability, messaging delivery guarantees, observability, and shutdown behavior. It also adds configuration options for event handling and checkpoint frequency.

Argov3.4.10CI/CD & App DeliveryOct 6, 2026

ACTION 1OTHER 8View full analysis

A maintenance release with routine dependency updates, bug fixes, and improved release provenance for container images and CLI binaries. It also includes an undisclosed coordinated security fix that requires an upgrade.

Action needed (1)

securityCoordinated security fixes
The release-3.4 branch includes coordinated security fixes in commit 4bc8085b0a6d2296b849539d3d09fc7be7a4a511 under issue #30039.

Argov3.5.4CI/CD & App DeliveryOct 6, 2026

ACTION 1OTHER 6View full analysis

A maintenance release with several correctness fixes, a coordinated security fix, and a small logging enhancement. It has no documented operator-facing breaking changes.

Action needed (1)

securityCoordinated security fixes
A coordinated security fix ships in the 3.5 release branch. The release note does not disclose the affected component or vulnerability details.

OpenFGAv1.22.0SecurityOct 6, 2026

ACTION 1CHECK 3OTHER 5View full analysis

A feature and maintenance release adds MySQL read-replica support, updates dependencies, and raises the minimum Go version. It also corrects SQL timestamp reporting and includes a gRPC update for GO-2026-6443.

Action needed (1)

securityhighThe google.golang.org/grpc dependency update for GO-2026-6443
The google.golang.org/grpc dependency was updated to v1.83.2 to resolve GO-2026-6443.

Check if affected (3)

breakingThe mysql.NewWithDB secondary database parameter
Applies if you use mysql.NewWithDB.
breakingThe sqlcommon authorization model functions
Applies if you use sqlcommon.ReadAuthorizationModel or sqlcommon.FindLatestAuthorizationModel.
breakingThe minimum Go version, raised to 1.26.0
Applies if you do not depend on go.

Rookv1.21.0Storage & DataOct 6, 2026

CHECK 4OTHER 6View full analysis

A breaking release changes Helm chart and Ceph defaults and removes automatic setup for some resources and images. It also adds storage and object-management capabilities, so chart references, kernel compatibility, new NFS installs, and custom CSI image settings may need review.

Check if affected (4)

breakingHelm OCI chart tag format
Applies if you reference Helm OCI chart tags in scripts or tooling.
breakingCeph msgrv2 default requirement
Applies if you cannot use msgrv2 because of an older kernel.
breakingAutomatic .nfs pool creation
Applies if you are creating a new NFS install.
+ 1 more on the release page

Envoyv1.39.3Networking & MessagingOct 6, 2026

CHECK 2View full analysis

A security maintenance release fixes two Envoy filter crashes. The fixes include safer handling of CONNECT requests without a :path header.

Check if affected (2)

securityGHSA-8vc2-jrm4-835w in the oauth2 filter
Applies to CONNECT requests without a :path header.
securityGHSA-47vj-9r25-wv5j in the api_key_auth filter
Applies if hide_credentials is enabled with a query key source.

Envoyv1.38.6Networking & MessagingOct 6, 2026

CHECK 2View full analysis

A security maintenance release fixes two request-triggered crashes in Envoy filters. One unsafe request pattern is rejected with HTTP 400.

Check if affected (2)

securityGHSA-8vc2-jrm4-835w: oauth2 filter handling for requests without :path
Applies if you use the oauth2 filter.
securityGHSA-47vj-9r25-wv5j: api_key_auth crash handling
Applies if you use api_key_auth with hide_credentials enabled and a query key source.

Envoyv1.37.8Networking & MessagingOct 6, 2026

CHECK 2View full analysis

A security maintenance release fixes crashes in the Envoy oauth2 and api_key_auth filters. The oauth2 filter now rejects requests without a :path header with HTTP 400, while the other fix covers a specific hide_credentials and query key source configuration.

Check if affected (2)

securityGHSA-8vc2-jrm4-835w in the oauth2 filter
Applies if the oauth2 filter receives requests without a :path header.
securityGHSA-47vj-9r25-wv5j in the api_key_auth filter
Applies if hide_credentials is enabled with a query key source and a request without a :path header is authenticated via another key source.

Jaegerv2.22.0ObservabilityOct 6, 2026

ACTION 1OTHER 56View full analysis

This release adds span search and pagination, promotes several feature gates, and includes numerous correctness fixes. It introduces no disclosed security changes.

Action needed (1)

breakingThe AI sidecar MCP URL default
The ai-sidecar now points its default MCP URL to query port 16686.

Envoyv1.36.12Networking & MessagingOct 6, 2026

CHECK 2View full analysis

A security maintenance release fixes two Envoy filter crash vulnerabilities. The oauth2 filter now rejects malformed requests without a :path header with HTTP 400.

Check if affected (2)

securityGHSA-8vc2-jrm4-835w in the oauth2 filter
Applies if you use the oauth2 extension.
securityGHSA-47vj-9r25-wv5j in the api_key_auth filter
Applies if you use the api_key_auth extension, configure hide_credentials, and configure query.

Harborv2.15.3Storage & DataOct 6, 2026

ACTION 16CHECK 1OTHER 27View full analysis

A security-focused maintenance release with numerous vulnerability fixes, dependency updates, and defensive limits. It also includes routine correctness, logging, and dependency maintenance changes.

Action needed (16)

securityPath traversal in distribution endpoints
Harbor fixes a path traversal vulnerability in distribution endpoints, tracked as GHSA-qj39-pjf2-wmrc.
securitySystem robot administrator escalation
Harbor fixes an issue where a system robot with user:update could make itself a system administrator, tracked as GHSA-w5fq-xrhj-j7g2.
securityRobot cross-project takeover through global scope
Harbor fixes a flaw where the Robot "cover all projects" scope could become a global wildcard and grant robot:update, enabling cross-project robot takeover and owner lockout. The issue is tracked as GHSA-xq2m-cj8w-56v5.
securityAuth-proxy admin authorization inheritance
Harbor fixes an authorization flaw where an external auth-proxy identity named admin inherited Registry system-administrator authorization. The issue is tracked as GHSA-xvh7-74g6-29xw.
securityImmutable tag rule selector matching
Harbor fixes immutable tag rule matching so that all repository and tag selectors are evaluated instead of only the first. The issue is tracked as GHSA-27f2-qg57-2gwg.
securityWebhook delivery SSRF
Harbor fixes an SSRF issue in webhook delivery that could let a ProjectAdmin reach internal services and cloud metadata endpoints. The issue is tracked as GHSA-2phj-cp9f-qq6w.
securityScanner bearer authorization request handling
Harbor fixes scanner bearer authorization requests that disabled TLS verification and read the full response body. The issue is tracked as GHSA-884q-mjcg-86x4.
securityJobservice webhook response decompression
Harbor prevents webhook error responses from causing unbounded decompression in Jobservice. The issue is tracked as GHSA-jw3v-7jvc-pfmx.
securityRegistry chunk upload Location headers
Harbor validates the Location headers reused during Registry chunk uploads. The issue is tracked as GHSA-wjpm-hv5w-gxr6.
securityVulnerability and Content-Trust pull policy enforcement
Harbor fixes a bypass of vulnerability and Content-Trust pull policies caused by an attacker-controlled User-Agent header. The issue is tracked as GHSA-wrw5-gmvj-gf23.
securityRegistry replication pagination Link handling
Harbor fixes SSRF and credential disclosure through an attacker-controlled pagination Link header in the Registry replication client. The issue is tracked as GHSA-xgp2-5vxg-rgh2.
securitySecurity middleware after AuthMode lookup failure
Harbor fixes security middleware behavior after an AuthMode lookup failure. The issue is tracked as GHSA-3x7c-wf86-mjx6.
securityProxy-cache poisoning through robot-name prefixes
Harbor prevents proxy-cache poisoning through a robot-name prefix.
securityGo dependency updates for CVE fixes
Harbor upgrades Go dependencies to fix CVEs.
breakingManifest upload size limit
Harbor adds a size limit for manifest uploads.
breakingAudit log payload size limit
Harbor adds a size limit for audit log payloads.

Check if affected (1)

securityscanner_registration.access_cred filtering
Applies if scanner_registration.access_cred is configured.

Linkerdedge-26.10.1Networking & MessagingOct 5, 2026

OTHER 19View full analysis

A maintenance release focused on dependency updates and a proxy version update. It does not state any changes to operator behavior.

Limav2.2.1Kubernetes CoreOct 3, 2026

ACTION 1CHECK 2OTHER 24View full analysis

A maintenance release focused on correctness, compatibility, performance, and template updates. It also changes a minimum toolchain requirement and a QEMU/HVF default, so those environments may require attention.

Action needed (1)

breakingqemuimgutil rejection of qcow2 external data file references
qemuimgutil now rejects qcow2 external data file references. The correctness fix ships in the image utility.

Check if affected (2)

breakinggo.mod minimum Go version raised to 1.26
Applies if you do not use Go 1.26.
breakingTPM PPI disabled on HVF with QEMU >= 11.0
Applies if you use HVF and QEMU >= 11.0.

Prometheusv3.13.4ObservabilityOct 2, 2026

ACTION 2OTHER 3View full analysis

A security-focused maintenance release updates a vulnerable Go dependency and refreshes UI npm dependencies. It also includes fixes for rollback compatibility, native histogram corruption, and failing scrapes.

Action needed (2)

securityhighgoogle.golang.org/grpc update for GO-2026-6348
The release updates google.golang.org/grpc to v1.83.1 to fix HTTP/2 DATA frame fragmentation memory exhaustion associated with GO-2026-6348.
securityUI npm dependency updates
The UI updates vulnerable npm dependencies.

wasmCloudv2.10.3Orchestration & ManagementOct 2, 2026

OTHER 9View full analysis

A maintenance release with dependency updates and correctness fixes for workload and plugin state cleanup. It includes fixes for state that outlived unbind, failed-stop cleanup, plugin unbind handling, and storage recreation, with no announced operator configuration changes.

CRI-Ov1.36.7Kubernetes CoreOct 2, 2026

View full analysis

Nothing here needs operator attention.

CRI-Ov1.34.15Kubernetes CoreOct 2, 2026

View full analysis

Nothing here needs operator attention.

CRI-Ov1.35.10Kubernetes CoreOct 2, 2026

View full analysis

Nothing here needs operator attention.

CRI-Ov1.37.2Kubernetes CoreOct 2, 2026

ACTION 1CHECK 1View full analysis

A maintenance release that updates the release bundle SBOM format and raises the required bom validation-tool version. No security change is stated.

Action needed (1)

breakingRelease bundle SBOM format
Release bundle SBOMs now use SPDX 3.0.1 JSON-LD and the .spdx.json suffix instead of SPDX 2.3 tag-value files with the .spdx suffix.

Check if affected (1)

breakingbom validation version requirement
Applicability is not stated in the release notes.

Cloud Custodian0.9.53.0SecurityOct 1, 2026

ACTION 2OTHER 30View full analysis

A feature-rich release expands resource and action coverage across AWS, Azure, GCP, Kubernetes, and core functionality. It also includes correctness fixes and behavior changes in existing AWS and Kubernetes integrations.

Action needed (2)

breakingAWS-managed resource exclusion for kms and route53 actions
Actions for kms and route53 now exclude AWS-managed resources.
breakingThe rename-tag action, removed from aws.cloudwatch-dashboard
The aws.cloudwatch-dashboard resource no longer supports the rename-tag action.

wasmCloudv2.10.2Orchestration & ManagementOct 1, 2026

OTHER 8View full analysis

A maintenance release covering runtime, gateway, registry, and logging correctness, along with dependency updates. No operator reconfiguration is stated.

Envoyv1.39.2Networking & MessagingOct 1, 2026

ACTION 1CHECK 1OTHER 1View full analysis

A security and packaging release that fixes a remotely exploitable TLS denial of service and removes Debian bullseye packaging. It also refreshes the Ubuntu build and distroless Docker base images without noted runtime configuration changes.

Action needed (1)

securitymediumCVE-2026-35189 TLS certificate parsing fix
BoringSSL was updated to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points. The fix addresses CVE-2026-35189, which could enable remote denial of service during TLS handshakes.

Check if affected (1)

breakingDebian bullseye (11) packaging removal
Applies if you use Debian bullseye (11) packaging.

Envoyv1.38.5Networking & MessagingOct 1, 2026

ACTION 2View full analysis

A security and packaging maintenance release with a BoringSSL fix for a remotely exploitable denial-of-service issue. It also removes Debian bullseye packaging and includes internal release-build updates.

Action needed (2)

securitymediumCVE-2026-35189 BoringSSL certificate parsing fix
This release patches BoringSSL to prevent excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could cause remote denial of service during TLS handshakes. The BoringSSL FIPS build using --config=boringssl-fips does not receive this patch.
breakingDebian bullseye (11) packaging removal
This release removes Debian bullseye (11) packaging because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

Envoyv1.37.7Networking & MessagingOct 1, 2026

ACTION 1CHECK 1View full analysis

A maintenance release with a BoringSSL fix for remote denial of service during TLS handshakes and the removal of Debian bullseye packaging. The fix does not apply to FIPS BoringSSL builds.

Action needed (1)

breakingDebian bullseye (11) packaging removal
Debian bullseye (11) packaging was removed because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

Check if affected (1)

securitymediumCVE-2026-35189 BoringSSL certificate parsing fix
Applies if you do not use the BoringSSL FIPS build (--define boringssl=fips).

Oct 13, 2026 – Oct 1, 2026Older →

Browse by month