Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.

Source ↗

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.

Source ↗

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Source ↗

Helmv4.1.3Kubernetes CoreMar 11, 2026

ACTION 1OTHER 13View full analysis

Helm v4.1.3 is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.

Action needed (1)

securityhighThe go.opentelemetry.io/otel/sdk dependency update for GO-2026-4394
The go.opentelemetry.io/otel/sdk dependency was updated to v1.40.0 for GO-2026-4394 in Helm v4.1.3.

Source ↗

containerdv2.2.2Kubernetes CoreMar 10, 2026

ACTION 1OTHER 14View full analysis

A maintenance release with defect corrections, behavior changes, and a fix for credential leakage in pod events. It also updates the Go toolchain and adds a warning for concurrent container creation.

Action needed (1)

securityCredential leakage prevention in pod events
Credential leakage is prevented in pod events in this containerd release.

Source ↗

CoreDNSv1.14.2Kubernetes CoreMar 6, 2026

ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

securityhighThe Go 1.26.1 build dependency and cited security fixes
The build uses Go 1.26.1, which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.

Check if affected (2)

securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.

Source ↗

Browse by month