Falco

0.45.0Security

Sep 21, 2026

A behavior-changing release with new reload and chart capabilities, operator-facing fixes, dependency updates, and security fixes. Rule evaluation semantics change for raw field bytes, and existing rules that depend on replacement-character matching may need review.

Action needed (3)

securitySymlink-safe pidfile opening
Falco opens the pidfile with O_NOFOLLOW. This prevents a symlink TOCTOU when the pidfile path is in an attacker-writable directory.
securityAbsolute modprobe path for kernel module loading
Falco uses the absolute modprobe path instead of a PATH lookup when it falls back to loading the kernel module. This addresses the untrusted search path issue identified as CWE-426.
breakingRule evaluation on raw field bytes
Falco now evaluates rule conditions on raw field bytes. Invalid and non-printable UTF-8 sequences can match string operators, single bytes can use the new \xHH escape sequence, regex operates on sanitized input, and non-printable or invalid characters are escaped or replaced at output encoding time. FALCO_ENGINE_VERSION changes from 0.62.0 to 0.63.0, so rules that matched the replacement character with non-regex operators need review.
falco#3942 @ekoops

Plan ahead (1)

deprecatedcontainer_engines configuration schema removal
The container_engines leftovers are removed from the Falco configuration JSON schema. Configurations that still set container_engines log a schema validation warning at startup.
falco#3924 @ekoops

All 20 other recorded changesfixes 13 · value changes 4 · additions 2 · constraints 1

fixes (13)

fix(falco): no unsupported syscalls warning is printed anymore when replaying a capture [[#4003](https://github.com/falcosecurity/falco/pull/4003)] - [@leogr](https://github.com/leogr)
fix(falco): the unsupported syscalls warning now points to base_syscalls.all instead of the removed -A flag [[#4001](https://github.com/falcosecurity/falco/pull/4001)] - [@leogr](https://github.com/leogr)
fix(packaging): restore Falco services and persistent kernel modules after upgrades, migrate package-default driver pins, and clean up package-created systemd state on removal [[#3994](https://github.com/falcosecurity/falco/pull/3994)] - [@leogr](https://github.com/leogr)
fix(chart): always mount an emptyDir at /etc/falco/config.d, and bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2 [[#3984](https://github.com/falcosecurity/falco/pull/3984)] - [@leogr](https://github.com/leogr)
fix(chart): mount the container engine socket directories instead of the socket files, so Falco keeps working after a container runtime restart [[#3978](https://github.com/falcosecurity/falco/pull/3978)] - [@leogr](https://github.com/leogr)
fix(chart): support DaemonSet revision history limits and honor an explicit zero for both DaemonSet and Deployment controllers. [[#3931](https://github.com/falcosecurity/falco/pull/3931)] - [@Goutham-Annem](https://github.com/Goutham-Annem)
fix(chart): do not render the falcoctl config volume when falcoctl artifact install and follow are disabled [[#3894](https://github.com/falcosecurity/falco/pull/3894)] - [@immanuwell](https://github.com/immanuwell)
fix(engine): falco --list no longer incorrectly labels the evt field class with a specific event source [[#3936](https://github.com/falcosecurity/falco/pull/3936)] - [@Wahid7852](https://github.com/Wahid7852)
fix(cmake): add support for 64K kernel page to jemalloc on aarch64 [[#3970](https://github.com/falcosecurity/falco/pull/3970)] - [@lekanjava](https://github.com/lekanjava)
fix(chart): correct the inverted priority level mappings in the Grafana dashboard, so severity labels match Falco's numeric priorities (0=emergency ... 7=debug) [[#3932](https://github.com/falcosecurity/falco/pull/3932)] - [@Goutham-Annem](https://github.com/Goutham-Annem)
fix(engine): correctly match wildcard patterns when the literal segment that follows a * appears more than once in the input (e.g. *.yaml against backup.yaml.yaml, or wildcard enable/disable of rule names whose names repeat a literal segment). [[#3913](https://github.com/falcosecurity/falco/pull/3913)] - [@tejgokani](https://github.com/tejgokani)
fix: serve SIGHUP-triggered hot restart when watch_config_files is disabled [[#3939](https://github.com/falcosecurity/falco/pull/3939)] - [@c2ndev](https://github.com/c2ndev)
fix(engine): do not emit the LOAD_NO_EVTTYPE warning for rules with statically unsatisfiable conditions (e.g. the never_true placeholder idiom) [[#3918](https://github.com/falcosecurity/falco/pull/3918)] - [@leogr](https://github.com/leogr)

value changes (4)

feat(userspace/falco): suggest --dry-run when --validate receives a Falco configuration file [[#3947](https://github.com/falcosecurity/falco/pull/3947)] - [@AkashKumar7902](https://github.com/AkashKumar7902)
update(build): bump falcoctl to 0.14.2 [[#3996](https://github.com/falcosecurity/falco/pull/3996)] - [@leogr](https://github.com/leogr)
bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2
The pidfile content now ends with a trailing newline

additions (2)

new(chart): add serviceAccount.labels to set custom labels on the ServiceAccount [[#3946](https://github.com/falcosecurity/falco/pull/3946)] - [@Goutham-Annem](https://github.com/Goutham-Annem)
feat(falco): Expose reload status through GET /reload and add optional reload control over a protected Unix socket on Linux. Preserve SIGHUP reception and pending requests across reloads. [[#4005](https://github.com/falcosecurity/falco/pull/4005)] - [@c2ndev](https://github.com/c2ndev)

constraints (1)

update(chart): bump the falcosidekick subchart constraint to 0.14.* and the falco-talon subchart constraint to 0.4.* [[#3990](https://github.com/falcosecurity/falco/pull/3990)] - [@leogr](https://github.com/leogr)

Add Falco to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Falco releases →