Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).

Source ↗

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.

Source ↗

Keycloak26.5.4SecurityFeb 20, 2026

ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
+ 1 more on the release page

Source ↗

Kyvernov1.17.1SecurityFeb 19, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.

Check if affected (1)

breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.

Source ↗

Kyvernov1.17.0SecurityFeb 2, 2026

ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.

Check if affected (2)

breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.

Source ↗

Browse by month