AI-analyzed release notes for CNCF graduated and incubating projects.
This release removes an orphan CRD, adds operator-facing capabilities and output changes, and corrects runtime, validation, reporting, and scan-processing defects. No security advisories or explicitly exploitable vulnerabilities are disclosed.
Check if affected (1)
breakingSecurityException CRD removal
Applies if you use the SecurityException CRD.
A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.
Check if affected (1)
breakingThe User-Agent header format
Applies if you configure server-side log filters or WAF rules that exact-match the old string.
cert-manager v1. changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.
Action needed (2)
securityhighGo v1. with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1. in cert-manager v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1. dependency upgrade
Go is upgraded to 1. as part of the dependency updates in cert-manager v1..
Check if affected (1)
securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.
Action needed (1)
securityhighGo updated to v1.
Go is updated to v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
Check if affected (1)
securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the MySQL backend.
securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
securityRequired OIDC issuer and audience configuration
Applies if authn. is set to oidc.
A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.
Action needed (2)
securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.
Check if affected (15)
securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
