RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Jun 2026Clear ×
Keycloak26.6.4SecurityJun 26, 2026
ACTION 8OTHER 1View full analysis

Version 26.6.4 is a security-focused Keycloak release with fixes for disclosed vulnerabilities. It also upgrades Quarkus to 3.33.2.1, an informational dependency change for operators.

Action needed (8)

  • securityhighCVE-2026-9099, group-admin escalation to realm-admin

    Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.

  • securityhighCVE-2026-9086, cross-site scripting via URI validation bypass

    Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.

  • securityhighCVE-2026-9795, improper scope mapping enforcement

    Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.

  • securityhighCVE-2026-9800, policy enforcer URI comparison

    Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.

  • securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass

    Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.

  • securitymediumCVE-2026-9083, arbitrary filesystem path probing

    Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.

  • securitymediumCVE-2026-9705, disabled client takeover

    Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.

  • securitymediumCVE-2026-9799, UMA permission ticket bypass

    Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.

Source ↗
cert-managerv1.19.6SecurityJun 25, 2026
ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

  • securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507

    Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

  • securityGo 1.25.10 dependency upgrade

    Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

  • securityReduced cert-manager-edit permissions for Challenge and Order creation and updates

    Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.

Source ↗
cert-managerv1.20.3SecurityJun 25, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

Check if affected (1)

  • securityThe cert-manager-edit aggregate ClusterRole permissions

    Applicability is not stated in the release notes.

Source ↗
Open Policy Agent (OPA)v1.17.1SecurityJun 8, 2026
ACTION 1View full analysis

A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.

Action needed (1)

  • securitymediumThe Go 1.26.4 build toolchain update

    OPA is built with Go 1.26.4 in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as GO-2026-5037 and GO-2026-5039.

Source ↗
OpenFGAv1.17.1SecurityJun 5, 2026
ACTION 2OTHER 3View full analysis

OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.

Action needed (2)

  • securityThe Go toolchain, updated to 1.26.4

    OpenFGA v1.17.1 updates the Go toolchain version to 1.26.4 to address Go standard library vulnerabilities.

  • securitygrpc-health-probe updated to v0.4.52

    Released images update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so they no longer ship the Go standard library vulnerabilities addressed by this update.

Source ↗
Keycloak26.6.3SecurityJun 4, 2026
ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

  • securityhighCVE-2026-4800 lodash code injection

    CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.

  • securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization

    CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

Source ↗
OpenFGAv1.17.0SecurityJun 2, 2026
ACTION 1OTHER 1View full analysis

OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.

Action needed (1)

  • securityTLV-based cache key generation

    OpenFGA v1.17.0 redesigns cache key generation with TLV binary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023