Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jun 2026Clear ×

Open Policy Agent (OPA)v1.17.1SecurityJun 8, 2026

ACTION 1View full analysis

A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.

Action needed (1)

securitymediumThe Go 1.26.4 build toolchain update
OPA is built with Go 1.26.4 in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as GO-2026-5037 and GO-2026-5039.

Crossplanev1.20.9Orchestration & ManagementJun 5, 2026

ACTION 1OTHER 2View full analysis

This Crossplane release combines dependency maintenance with a new CLI check for upgrade readiness. The check scans a live v1.x control plane for features removed or changed in Crossplane v2 and reports what would break before an upgrade.

Action needed (1)

securityThe golang.org/x/net module, updated to v0.55.0
The golang.org/x/net module is updated to v0.55.0 in Crossplane v1.20.9. The release note marks this dependency update as security-related, but does not identify a specific vulnerability.

OpenFGAv1.17.1SecurityJun 5, 2026

ACTION 2OTHER 3View full analysis

OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.

Action needed (2)

securityThe Go toolchain, updated to 1.26.4
OpenFGA v1.17.1 updates the Go toolchain version to 1.26.4 to address Go standard library vulnerabilities.
securitygrpc-health-probe updated to v0.4.52
Released images update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so they no longer ship the Go standard library vulnerabilities addressed by this update.

Istio1.29.4Networking & MessagingJun 4, 2026

ACTION 1OTHER 6View full analysis

A maintenance release with a security fix for Envoy and operator-relevant correctness fixes across Istio ambient, gateway, routing, and CNI behavior. It also adds automatic fallback from the nftables backend to iptables when the bundled nft binary lacks JSON support.

Action needed (1)

securityhighCVE-2026-47774 Envoy memory exhaustion fix
CVE-2026-47774 fixes an Envoy memory exhaustion issue in which specially crafted HTTP/2 requests could bypass request header size accounting and trigger excessive memory use. The fix ships in Envoy.

Istio1.28.8Networking & MessagingJun 4, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with a disclosed Envoy denial-of-service fix and additional correctness fixes. The security fix addresses memory exhaustion from specially crafted HTTP/2 requests, while the other corrections do not require setup changes.

Action needed (1)

securityhighThe Envoy denial-of-service vulnerability CVE-2026-47774, fixed
CVE-2026-47774 fixes an Envoy denial-of-service vulnerability in which specially crafted HTTP/2 requests could cause excessive memory consumption. The fix accounts for cookie header bytes during request header size validation and limits total decoded header size in HPACK processing.

Istio1.30.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

securityhighCVE-2026-47774 Envoy denial-of-service fix
The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet
Applies if you use the ListenerSet API.

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
+ 12 more on the release page

Envoyv1.37.3Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

securityhighnghttp2 CVE-2026-27135 patch
The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

securityhighHTTP/2 header list limits and cookie accounting
Applies if you use HTTP/2.
securityOAuth2 HMAC verification timing
Applies if you use oauth2.

Envoyv1.36.7Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 with configured header list or request-header limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use the OAuth2 filter.

Envoyv1.35.11Networking & MessagingJun 3, 2026

ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

securityhighHTTP/2 header limits and cookie accounting
Applies if you use HTTP/2 request header limits.
securityOAuth2 HMAC verification timing protection
Applies if you use OAuth2 HMAC verification.

KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026

ACTION 2PLAN 1OTHER 13View full analysis

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

securitycriticalgoogle.golang.org/grpc update to 1.79.3
The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.
securitySymlink traversal fix in the VMExport directory handler
The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules
Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

KubeVirtv1.7.4Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 5View full analysis

KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency update for CVE-2026-33186
KubeVirt v1.7.4 updates google.golang.org/grpc to version 1.79.3 to remediate CVE-2026-33186.

KubeVirtv1.6.6Orchestration & ManagementJun 3, 2026

ACTION 1OTHER 8View full analysis

KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.

Action needed (1)

securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186
KubeVirt v1.6.6 bumps google.golang.org/grpc to remediate CVE-2026-33186.

Jaegerv2.19.0ObservabilityJun 3, 2026

ACTION 1OTHER 15View full analysis

This release adds API and storage capabilities, updates API query naming and defaults, and includes correctness fixes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingThe searchdepth default in the trace-summaries endpoint
The default for searchdepth changed in the trace-summaries endpoint.

wasmCloudv2.3.0Orchestration & ManagementJun 3, 2026

ACTION 2OTHER 12View full analysis

Version v2.3.0 adds workload configuration and telemetry capabilities while correcting wash and runtime defects. It also changes RBAC scope support and updates dependencies, including security patches and reported advisory fixes.

Action needed (2)

securityThe wasmtime 44.0.2 security patch
The release updates wasmtime to 44.0.2 as a security patch.
securityReported dependency security advisories
The dependency set includes patches for reported security advisories.

containerdv2.1.8Kubernetes CoreJun 2, 2026

ACTION 1OTHER 4View full analysis

containerd v2.1.8 includes a disclosed security correction identified by CVE-2026-46680 and GHSA-fqw6-gf59-qr4w. The release also contains operator-facing runtime and snapshotter changes in its broader changelog.

Action needed (1)

securityhighCVE-2026-46680 security correction
containerd v2.1.8 includes a correction for CVE-2026-46680, associated with GHSA-fqw6-gf59-qr4w.

OpenFGAv1.17.0SecurityJun 2, 2026

ACTION 1OTHER 1View full analysis

OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.

Action needed (1)

securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with TLV binary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.

etcdv3.5.31Kubernetes CoreJun 1, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with correctness fixes and dependency updates. The golang.org/x/crypto update addresses GO-2026-5026.

Action needed (1)

securitycriticalThe golang.org/x/crypto dependency update for GO-2026-5026
The golang.org/x/crypto dependency is updated to v0.52.0 to address GO-2026-5026.

Volcanov1.15.0Orchestration & ManagementJun 1, 2026

ACTION 4CHECK 2OTHER 83View full analysis

A feature and operational-hardening release that adds alpha scheduling capabilities, new scheduler and Helm configuration, and fixes scheduler and integration stability issues. Operators should review Kubernetes and DRA compatibility requirements, the changed DRA default, and the disclosed denial-of-service and Prometheus security fixes.

Action needed (4)

securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99
Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.
securitymediumAdmission webhook request body limits
The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.
breakingDRA scheduling integration default
DRA scheduling integration is enabled by default.
breakingDRA scheduling integration default behavior
DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.

Check if affected (2)

breakingOpt-in SchedulingGatesQueueAdmission
Applies if you enable SchedulingGatesQueueAdmission.
breakingOpt-in gang-aware preemption and reclamation
Applies if you configure gangPreempt and gangReclaim and do not configure preempt or reclaim.

← NewerJun 8, 2026 – Jun 1, 2026

Browse by month