RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
CoreDNSv1.14.7Kubernetes CoreAug 19, 2026
ACTION 1CHECK 3OTHER 42View full analysis

A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.

Action needed (1)

Check if affected (3)

  • securityplugin/acl autopath ACL checks

    Applies if you use plugin/acl and autopath.

  • breakingplugin/forward default connection attempts

    Applies if you use plugin/forward.

  • breakingplugin/hosts unsupported-type fallthrough

    Applies if you use plugin/hosts.

Source ↗
etcdv3.7.1Kubernetes CoreJul 23, 2026
ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

  • securityhighThe google.golang.org/grpc dependency update

    The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default

    The release sets a reasonable default value for snapshotLimitByte.

  • breakingThe client HTTP server ReadHeaderTimeout

    The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

  • securityhighWatch responses restricted to authorized keys

    Applicability is not stated in the release notes.

Source ↗
etcdv3.7.0Kubernetes CoreJul 8, 2026
ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if you configure --listen-client-http-urls.

Source ↗
etcdv3.6.13Kubernetes CoreJul 1, 2026
ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

  • securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0

    The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

  • securityhighgolang.org/x/crypto, updated to v0.52.0

    The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if --listen-client-http-urls is configured.

Source ↗
etcdv3.5.32Kubernetes CoreJul 1, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

  • securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883

    go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

  • securityCRL enforcement with --listen-client-http-urls

    Applies if --listen-client-http-urls is configured.

Source ↗
Limav2.1.3Kubernetes CoreJun 19, 2026
CHECK 5OTHER 2View full analysis

A maintenance release that changes several defaults, updates dependencies, and fixes multiple security vulnerabilities. It also includes a fallback to scp for remote sources and destinations in auto mode.

Check if affected (5)

  • securitycriticalcontainerd v2.3.2 security fixes

    Applies if you use containerd.

  • securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix

    Applies if you run a QEMU VM that uses the guest agent socket.

  • breakingcontainerd.user default on non-Linux guests

    Applies if you run non-Linux guests.

  • + 2 more on the release page
Source ↗
Helmv4.2.0Kubernetes CoreMay 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

  • securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394

    Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

  • securityPlugin version path traversal fix

    Applies if you use the Plugin extension.

Plan ahead (1)

  • deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated

    Applies if you use --hide-notes or --render-subchart-notes.

Source ↗
etcdv3.6.11Kubernetes CoreMay 1, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

  • securitymediumgolang.org/x/image update for GO-2026-4962

    The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

  • securityRBAC authorization bypass in nested Put requests

    Applies if you use RBAC.

Source ↗
etcdv3.4.44Kubernetes CoreMay 1, 2026
CHECK 1OTHER 1View full analysis

A security maintenance release fixes an RBAC authorization bypass. It also updates the Go toolchain used to compile binaries to go 1.25.9.

Check if affected (1)

  • securityRBAC authorization bypass fix

    Applies if you use RBAC.

Source ↗
containerdv2.0.8Kubernetes CoreApr 14, 2026
ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

  • securityhighThe spdystream update for CVE-2026-35469

    The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

  • securityCredential sanitization before gRPC returns

    Applies if you use pod events through the Container Runtime Interface (CRI).

Source ↗
containerdv2.1.7Kubernetes CoreApr 14, 2026
ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

  • securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2

    The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.

  • securityhighgithub.com/moby/spdystream v0.5.1 update

    The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

  • securityCredential sanitization before gRPC returns

    Applies if pod events are used.

Source ↗
containerdv1.7.31Kubernetes CoreApr 14, 2026
ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

Check if affected (1)

  • securitySanitized gRPC errors in pod events

    Applies if you use pod events.

Source ↗
Helmv3.20.2Kubernetes CoreApr 9, 2026
CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

  • securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse

    Applies if you use Helm Chart extraction.

Source ↗
Helmv4.1.4Kubernetes CoreApr 9, 2026
ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

  • securitymediumGHSA-hr2v-4r36-88hr security fix

    GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

  • securityhighPlugin verification when .prov is missing

    Applies if you use plugins.

  • securityhighPlugin metadata version path traversal

    Applies if you use plugins.

Source ↗
Limav2.1.1Kubernetes CoreApr 3, 2026
CHECK 1OTHER 4View full analysis

A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.

Check if affected (1)

  • securityBuildKit and CNI plugins security updates

    Applies if you use BuildKit or CNI plugins.

Source ↗
etcdv3.6.9Kubernetes CoreMar 20, 2026
ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

  • securitycriticalgoogle.golang.org/grpc updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413

    The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.

  • securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.

  • securityhighgolang.org/x/net updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

  • securitylowRBAC checks for nested etcd transactions, CVE-2026-33343

    Applies if you use nested etcd transactions and RBAC.

Source ↗
etcdv3.5.28Kubernetes CoreMar 20, 2026
ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

  • securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.

  • securityhighThe golang.org/x/net dependency, updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

  • securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)

    Applies if you use unauthenticated endpoints.

  • securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)

    Applies if you use nested txn ops.

Source ↗
CoreDNSv1.14.2Kubernetes CoreMar 6, 2026
ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

Check if affected (2)

  • securityhighThe rewrite and acl ordering, CVE-2026-26017

    Applies if you use both rewrite and acl.

  • securityhighplugin/loop query name generation, CVE-2026-26018

    Applies if plugin/loop runs.

Source ↗
CoreDNSv1.14.1Kubernetes CoreJan 16, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A security-focused maintenance release addresses disclosed Go vulnerabilities and improves proxy connection-pool performance. It also adds the forward plugin's max_idle_conns parameter, which defaults to 0 for an unbounded pool.

Action needed (1)

  • securityhighCVE-2025-68119 fix

    The release also addresses CVE-2025-68119, which affects the stated Go versions.

Check if affected (1)

  • securitycriticalGo security vulnerability fixes

    Applicability is not stated in the release notes.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023