Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: etcdClear ×

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.
The watch permission issue covered by GHSA-xg4h-6gfc-h4m8 is fixed. A user granted read permission on one key no longer receives watch responses for every key starting from that key.

etcdv3.6.14Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

securitycriticalThe golang.org/x/net dependency update
The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.
securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8
An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3
The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.
securityhighThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default value
The default value for snapshotLimitByte is set to a reasonable value in this release.

etcdv3.5.33Kubernetes CoreJul 23, 2026

ACTION 5OTHER 5View full analysis

A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.

Action needed (5)

securityhighWatch response authorization for key ranges
The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.
securityhighThe tlsHandshakeTimeout setting for tlsListener
A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.
securityhighThe golang.org/x/net dependency, updated to v0.56.0
The golang.org/x/net dependency is updated to v0.56.0 to address GO-2026-5942.
securityhighThe golang.org/x/text dependency, updated to v0.39.0
The golang.org/x/text dependency is updated to v0.39.0 to address GO-2026-5970.
securityhighThe google.golang.org/grpc dependency, updated to 1.82.1
The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

etcdv3.7.0Kubernetes CoreJul 8, 2026

ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

securityhighgolang.org/x/crypto updated to v0.52.0
The release updates golang.org/x/crypto to v0.52.0 to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
The release fixes a CRL enforcement bypass on the gRPC listener when --listen-client-http-urls is configured. See advisory GHSA-3wh4-j44w-pg92 for details.

etcdv3.6.13Kubernetes CoreJul 1, 2026

ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0
The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang.org/x/crypto, updated to v0.52.0
The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.
This release fixes the CRL enforcement bypass on the gRPC listener when --listen-client-http-urls is configured. The fix addresses GHSA-3wh4-j44w-pg92.

etcdv3.5.32Kubernetes CoreJul 1, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.
The gRPC listener now enforces CRLs when --listen-client-http-urls is configured. This fixes GHSA-3wh4-j44w-pg92.

etcdv3.5.31Kubernetes CoreJun 1, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with correctness fixes and dependency updates. The golang.org/x/crypto update addresses GO-2026-5026.

Action needed (1)

securitycriticalThe golang.org/x/crypto dependency update for GO-2026-5026
The golang.org/x/crypto dependency is updated to v0.52.0 to address GO-2026-5026.

etcdv3.6.11Kubernetes CoreMay 1, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

securitymediumgolang.org/x/image update for GO-2026-4962
The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.
The release fixes an RBAC authorization bypass that could allow read access through PrevKv or lease attachment in Put requests nested in etcd transactions.

etcdv3.5.30Kubernetes CoreMay 1, 2026

ACTION 1OTHER 2View full analysis

A maintenance release with a security fix for an RBAC authorization bypass in transaction handling. It also includes an ordinary correctness fix and a Go toolchain dependency update.

Action needed (1)

securityRBAC authorization bypass in nested etcd transactions
The release fixes an RBAC authorization bypass that allowed read access through PrevKv or lease attachment in Put requests nested in etcd transactions. The fix ships in this release.

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
The etcd server fixes RBAC authorization checks for nested etcd transactions. The issue is identified by CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
Authentication checks now guard unauthenticated endpoints in v3.5.28, addressing authorization bypasses in multiple APIs (CVE-2026-33413).
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
Authentication checks now apply to nested etcd transactions in v3.5.28, addressing RBAC authorization bypasses (CVE-2026-33343).

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

etcdv3.6.8Kubernetes CoreFeb 13, 2026

ACTION 2PLAN 1OTHER 1View full analysis

A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.

Action needed (2)

securityhighThe go toolchain, updated to 1.24.13
Binaries are compiled using go 1.24.13. The toolchain update addresses CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
securitymediumThe golang.org/x/crypto dependency, updated to 0.45.0
golang.org/x/crypto is updated to 0.45.0 to address CVE-2025-47914 and CVE-2025-58181.

Plan ahead (1)

deprecatedThe --max-snapshots flag, removal postponedremoval planned in v3.8
Applies if you use --max-snapshots.
Removal of --max-snapshots is postponed from v3.7 to v3.8.

etcdv3.5.27Kubernetes CoreFeb 13, 2026

ACTION 1View full analysis

A maintenance release that changes the Go toolchain used to compile binaries. It also includes fixes for three named CVEs and their corresponding GHSA advisories.

Action needed (1)

securityhighGo 1.24.13 toolchain for compiled binaries
Binaries are compiled with Go 1.24.13. This release includes fixes for CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, with corresponding advisories GHSA-gm9r-q53w-2gh4, GHSA-xvqr-69v8-f3gv4, and GHSA-8jvr-vh7g-f8gx.

etcdv3.4.41Kubernetes CoreFeb 13, 2026

ACTION 1View full analysis

A maintenance release updates the Go dependency and toolchain to go 1.24.13. It addresses three CVEs and their corresponding GitHub advisories.

Action needed (1)

securityhighGo 1.24.13 dependency and toolchain update
The Go dependency and toolchain update to go 1.24.13 addresses CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, along with GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.

Browse by month