Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×

Daprv1.16.12Orchestration & ManagementMar 30, 2026

ACTION 1CHECK 2OTHER 4View full analysis

A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution
The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (2)

breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
breakingStructural validation for .jsonschema topics
Applies if you configure .jsonschema.

cert-managerv1.20.1SecurityMar 27, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.

Action needed (1)

securityThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.

Emissary-Ingressv4.0.1Networking & MessagingMar 26, 2026

ACTION 1CHECK 6OTHER 14View full analysis

A release with operator-facing compatibility changes, including feature removals, aligned chart and application versions, GHCR-only chart distribution, and a changed CRD conversion-webhook default. It also updates dependencies and the Python interpreter to resolve CVEs, with additional defect fixes and new service and architecture capabilities.

Action needed (1)

securityDependency and Python interpreter updates for CVE fixes
Many dependencies and the Python interpreter were updated to resolve CVEs.

Check if affected (6)

breakingCustom error responses and header-case mangling, removed
Applies if you use Ambassador Edge Stack's custom error responses or header-case mangling features.
breakingHelm chart and Emissary version alignment
Applies if you use the Helm chart.
breakingGHCR-only Helm chart distribution
Applies if you use Emissary's Helm charts.
+ 3 more on the release page

Daprv1.17.3Orchestration & ManagementMar 26, 2026

ACTION 2OTHER 12View full analysis

Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.

Action needed (2)

securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186
The google.golang.org/grpc dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang.org/x/image dependency, updated for CVE-2026-33809
This release upgrades golang.org/x/image from v0.25.0 to v0.38.0, resolving CVE-2026-33809.

Daprv1.16.11Orchestration & ManagementMar 26, 2026

ACTION 1OTHER 4View full analysis

This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.

Action needed (1)

securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.

Argov3.2.8CI/CD & App DeliveryMar 26, 2026

ACTION 1OTHER 2View full analysis

This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.

Action needed (1)

securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3.2 line.

Argov3.1.13CI/CD & App DeliveryMar 25, 2026

ACTION 1OTHER 3View full analysis

Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.

Action needed (1)

securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.

Chaos Meshv2.8.2ObservabilityMar 25, 2026

ACTION 2CHECK 1PLAN 1OTHER 6View full analysis

A maintenance release deprecates and removes install.sh, updates the Go toolchain and JSON-RPC dependency, and corrects dashboard and webhook issues. It also includes vulnerability fixes in Go and UI packages.

Action needed (2)

securityGo package updates for vulnerability fixes
Go packages are upgraded to fix vulnerabilities.
securityUI package updates for vulnerability fixes
UI packages are upgraded to fix vulnerabilities.

Check if affected (1)

breakingThe install.sh installer, removed
Applies if you use install.sh.

Plan ahead (1)

deprecatedThe install.sh installer, deprecated
Applies if you use install.sh.

NATSv2.12.6Networking & MessagingMar 24, 2026

ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

breakingJWT size limit
JWTs now have a 1MB size limit.

Check if affected (13)

securityhighMQTT security fixes
Applies if you use MQTT.
securityhighLeafnode security fix
Applies if you use leafnodes.
securityhighCommand-line credential security fix
Applies if you provide credentials on the command line.
+ 10 more on the release page

NATSv2.11.15Networking & MessagingMar 24, 2026

ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

breakingThe JWT size limit
JWTs now have a 1MB size limit.

Check if affected (11)

securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
+ 8 more on the release page

Contourv1.33.3Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.

Action needed (2)

securitycriticalgoogle.golang.org/grpc v1.79.3 update
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.
securityEnvoy v1.35.9 update
The Envoy dependency is updated to v1.35.9 to address security vulnerabilities.

Check if affected (1)

breakingRemoval of hostPort: 8002 from example manifests
Applies if you use hostPort in example manifests.

Contourv1.32.4Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3
google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

breakinghostPort: 8002 removed from example manifests
Applies if hostPort: 8002 is configured in example manifests.

Contourv1.31.5Networking & MessagingMar 23, 2026

ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186
The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.
securityEnvoy updated to v1.34.13
The release bumps Envoy to v1.34.13.

Check if affected (1)

breakingEnvoy metrics hostPort: 8002 removed from example manifests
Applies if example manifests use hostPort: 8002.

wasmCloudv2.0.0Orchestration & ManagementMar 22, 2026

ACTION 2OTHER 8View full analysis

wasmCloud v2.0.0 adds operator-facing capabilities, changes CRD locations, updates dependencies, and fixes runtime and CLI behavior. The dependency update addresses the disclosed advisory RUSTSEC-2026-0007.

Action needed (2)

securitymediumLock file update for RUSTSEC-2026-0007
wasmCloud v2.0.0 updates the lock file to address RUSTSEC-2026-0007.
breakingCRD location moved from templates/crds to /crds
wasmCloud v2.0.0 moves CRDs from templates/crds to /crds.

Kubeflow26.03AI & MLMar 22, 2026

ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

breakingBaseline pod security enforcement
Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

breakingKubernetes 1.34+ requirement
Applies if you use Kubernetes 1.34+.

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Harborv2.15.0Storage & DataMar 20, 2026

ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.

KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026

ACTION 1OTHER 7View full analysis

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.

KServev0.17.0AI & MLMar 13, 2026

ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

securitycriticalh11 malformed-body fix for CVE-2025-43859
h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.
securityhighstarlette version 0.49.1
starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.
securityhighlightgbm version 4.6.0
lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.
securityhighCVE-2025-66418 decompression-chain fix
The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.
securityhighexpr-lang/expr version v1.17.7
expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.
securityhighcryptography fix for CVE-2026-26007
The cryptography issue associated with CVE-2026-26007 is addressed in this release.
securityhighpython-multipart fix for CVE-2026-24486
The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.
securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181
This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.
securityhttps.go path traversal prevention
The path traversal issue in https.go is prevented in this release.
securitySeveral CVE fixes
This release addresses several CVEs.
securityAIOHTTP HTTP Parser auto_decompress fix
The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.
securityextractTarFiles path traversal fix
The path traversal vulnerability in extractTarFiles is addressed in this release.
breakingminio replacement with seaweedfs
minio is replaced with seaweedfs in this release.

Check if affected (6)

breakinginferenceservice CRD cert-manager annotation removal
Applies if you use the inferenceservice CRD.
breakingPython 3.9 support removal
Applies if you run Python 3.9.
breakingDeprecated --disable-log-requests flag removal
Applies if you configure --disable-log-requests.
+ 3 more on the release page

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Strimzi0.45.2Networking & MessagingMar 12, 2026

ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

securityhighGRPC Netty Shaded update for CVE-2025-55163
GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.
securitymediumZookeeper update for CVE-2024-47554
The Zookeeper dependency was upgraded to remediate CVE-2024-47554.
securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864
Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.
securitymediumNetty 4.1.130.Final update for CVE-2025-67735
Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.
securitymediumApache Log4J 2.25.3 update for CVE-2025-68161
Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.
securitymediumVertx 4.5.24 update for CVE-2026-1002
Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.
securitymediumJackson update for GHSA-72hv-8253-57qq
Jackson was updated to address GHSA-72hv-8253-57qq.
securityVert.x and Netty dependency updates
The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

breakingKubernetes support narrowed to 1.25 and newer
Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46
Applies if you use the Strimzi MirrorMaker 2 Extensions.
breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46
Applies if you use the Strimzi EnvVar Configuration Provider.
deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46
Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Fluxv2.8.2CI/CD & App DeliveryMar 12, 2026

ACTION 1OTHER 7View full analysis

Flux v2.8.2 includes correctness fixes and dependency updates. It also fixes a disclosed TLS-handshake denial-of-service issue in the controller builds.

Action needed (1)

securitymediumCVE-2026-27138 TLS-handshake DoS fix
The TLS-handshake denial-of-service issue identified as CVE-2026-27138 is fixed by building all controllers with Go 1.26.1.

Helmv4.1.3Kubernetes CoreMar 11, 2026

ACTION 1OTHER 13View full analysis

Helm v4.1.3 is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.

Action needed (1)

securityhighThe go.opentelemetry.io/otel/sdk dependency update for GO-2026-4394
The go.opentelemetry.io/otel/sdk dependency was updated to v1.40.0 for GO-2026-4394 in Helm v4.1.3.

Backstagev1.48.5CI/CD & App DeliveryMar 11, 2026

ACTION 1View full analysis

A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Action needed (1)

securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Envoyv1.37.1Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.

Envoyv1.36.5Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.

Envoyv1.35.9Networking & MessagingMar 10, 2026

ACTION 4OTHER 2View full analysis

Envoy v1.35.9 is a maintenance release with security fixes in RBAC, network address handling, JSON processing, and HTTP downstream reset handling. It also includes an ordinary defect correction and an updated Docker base-image dependency.

Action needed (4)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5, multivalue header bypass in RBAC
Envoy v1.35.9 fixes CVE-2026-26308 and GHSA-ghc4-35x6-crw5, addressing a multivalue header bypass in RBAC.
securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p, scoped IPv6 address crash
Envoy v1.35.9 fixes CVE-2026-26310 and GHSA-3cw6-2j68-868p, preventing a crash in getAddressWithPort() when it receives a scoped IPv6 address.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943, JSON null-terminator write
Envoy v1.35.9 fixes CVE-2026-26309 and GHSA-56cj-wgg3-x943, correcting an off-by-one write that could corrupt the string null terminator in JSON handling.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px, HTTP decode methods after downstream reset
Envoy v1.35.9 fixes CVE-2026-26311 and GHSA-84xm-r438-86px, ensuring that decode* methods are blocked after a downstream reset in HTTP handling.

containerdv2.2.2Kubernetes CoreMar 10, 2026

ACTION 1OTHER 14View full analysis

A maintenance release with defect corrections, behavior changes, and a fix for credential leakage in pod events. It also updates the Go toolchain and adds a warning for concurrent container creation.

Action needed (1)

securityCredential leakage prevention in pod events
Credential leakage is prevented in pod events in this containerd release.

Envoyv1.34.13Networking & MessagingMar 10, 2026

ACTION 4OTHER 2View full analysis

A release with disclosed security fixes in RBAC, network handling, JSON processing, and HTTP decoding, plus an OAuth2 correctness fix and updated Docker base images. Upgrading addresses the security vulnerabilities, while the other fixes require no operator action.

Action needed (4)

securityhighCVE-2026-26308 multivalue header bypass in rbac
CVE-2026-26308 (GHSA-ghc4-35x6-crw5) fixes a multivalue header bypass in rbac. The fix ships in this Envoy release.
securitymediumCVE-2026-26310 crash in getAddressWithPort()
CVE-2026-26310 (GHSA-3cw6-2j68-868p) fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The fix ships in the Envoy network code.
securitymediumCVE-2026-26309 off-by-one write in json processing
CVE-2026-26309 (GHSA-56cj-wgg3-x943) fixes an off-by-one write that could corrupt the string null terminator. The fix ships in the Envoy json code.
securitymediumCVE-2026-26311 blocking of decode* methods after downstream reset
CVE-2026-26311 (GHSA-84xm-r438-86px) ensures that decode* methods are blocked after a downstream reset. The fix ships in the Envoy http code.

Istio1.29.1Networking & MessagingMar 10, 2026

ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-26311 HTTP decode method restriction
Applies if you use HTTP.
+ 7 more on the release page

Istio1.28.5Networking & MessagingMar 10, 2026

ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

securityhighCVE-2026-26308 multivalue header bypass fix in RBAC
CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method fix
CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write in Istio.
securitymediumCVE-2026-26330 ratelimit response phase crash fix
CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

securityAuthentication for XDS debug endpoints on port 15010
Applies if you expose XDS debug endpoints.
securityBearer token realm URL validation for WasmPlugin image fetching
Applies if you use WasmPlugin image fetching.
securityNamespace-based authorization for HTTP debug endpoints on port 15014
Applies if you expose HTTP debug endpoints.

Istio1.27.8Networking & MessagingMar 10, 2026

ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

securitymediumCVE-2026-26311 HTTP decode method correction
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix
Applies if you use Debug Endpoints.
+ 3 more on the release page

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
+ 1 more on the release page

Harborv2.13.5Storage & DataMar 10, 2026

ACTION 1OTHER 5View full analysis

Bearer tokens issued before project creation are rejected. The release also updates dependencies and components and removes payload data from the configuration audit log.

Action needed (1)

securityRejection of bearer tokens issued before project creation
The security enforcement rejects bearer tokens issued before project creation.

Harborv2.14.3Storage & DataMar 10, 2026

ACTION 1OTHER 7View full analysis

This release updates base images, dependencies, and Trivy components, and changes the audit-log payload. It also rejects bearer tokens issued before project creation.

Action needed (1)

securityBearer tokens issued before project creation rejected
The security fix rejects bearer tokens issued before project creation.

Mar 30, 2026 – Mar 10, 2026Older →

Browse by month