Releases

Check if affected (4)

• breakingThe YurtAppOverrider removal

  Applies if you use YurtAppOverrider.

• breakingThe yurt-coordinator removal from Helm charts

  Applies if you use both yurt-coordinator and Helm charts.

• breakingThe yurt-coordinator-cert controller removal from yurt-manager

  Applies if you use both yurt-coordinator-cert controller and yurt-manager.

• + 1 more on the release page

Check if affected (1)

• breakingThe canary-v2 configuration, removed in favor of canary

  Applies if you configure canary-v2.

Check if affected (1)

• breakingMinimum supported Kubernetes version, 1.31

  Applies when your cluster runs Kubernetes older than 1.31.

Check if affected (1)

• breakingThe retained-message subject constraint

  Applies if you use retained messages.

Action needed (3)

• securityClear-text logging of sensitive information

  The release addresses a code scanning alert about clear-text logging of sensitive information.

• securityDirectory traversal protection in GetBackups

  The file backup storage GetBackups RPC no longer permits directory traversal paths.

• breakingStricter VTGate SELECT list validation

  VTGate rejects an unqualified * after a comma in a SELECT list.

Check if affected (1)

• breakingThe Container sandbox metadata field, removed

  Applies if you use Container in API specs.

Action needed (3)

• securityhighCVE-2026-32597 PyJWT validation fix

  PyJWT crit header validation was fixed for CVE-2026-32597.

• securityhighCVE-2026-30922 pyasn1 fix

  The pyasn1 dependency was updated to address CVE-2026-30922 and its denial-of-service vulnerability.

• breakingRequired MaxReplicas field

  MaxReplicas is now required and must use the int32 type.

Action needed (4)

• securityhighIntermediate certificate limit for CVE-2026-32280

  Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.

• securityhighGo toolchain upgraded to 1.26.2 for CVE-2026-32283

  The Go toolchain is upgraded to 1.26.2 to fix CVE-2026-32283.

• securitymediumgo-tuf/v2 upgraded to v2.4.1 for CVE-2026-24686

  go-tuf/v2 is upgraded to v2.4.1 to fix CVE-2026-24686.

• securityStandard library CVE fixes

  Standard library CVEs are fixed in this release.

Check if affected (2)

• breakingRelative replace paths in generated Collector source

  Applies if you use the generated Collector source.

• breakingNamed Config.Protocols field

  Applies if you use Config.Protocols.

Check if affected (1)

• breakingThe MCP_SERVER_ENABLED default, changed to false

  Applies if MCP_SERVER_ENABLED is not configured.

Action needed (2)

• breakingThe UseConnectBuildWithBuildah feature gate, enabled by default

  The UseConnectBuildWithBuildah feature gate moves to the beta stage and is enabled by default.

• breakingThe /metrics endpoint, moved to the HTTP management interface

  The /metrics endpoint is no longer available on the regular HTTP interface, which uses port 8080 by default. It is now available on the HTTP management interface on port 8081.

Action needed (18)

• securitycriticalLinux security updates

  Linux was updated with security fixes associated with advisories including CVE-2024-56757, CVE-2025-71239, and CVE-2026-31788.

• securityhighcurl security updates

  curl was updated with fixes for CVE-2025-10148 and CVE-2025-9086.

• securityhighexpat security update

  expat was updated with a fix for CVE-2025-59375.

• securityhighgnupg security updates

  gnupg was updated with fixes for CVE-2025-68972 and CVE-2025-68973.

• securityhighGo security updates

  go was updated with security fixes associated with CVE-2025-47910, CVE-2025-47912, CVE-2025-58183, and related advisories.

• securityhighintel-microcode security updates

  intel-microcode was updated with fixes associated with CVE-2024-28956, CVE-2024-43420, CVE-2025-20012, and related advisories.

• securityhighlibxslt security updates

  libxslt was updated with fixes for CVE-2025-7424 and CVE-2025-7425.

• securityhighnvidia-drivers security updates

  nvidia-drivers was updated with fixes for CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, and related advisories.

• securityhighopenssl security updates

  openssl was updated with fixes for CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232.

• securityhighPAM security updates

  pam was updated with fixes for CVE-2024-10041, CVE-2024-10963, CVE-2024-22365, and CVE-2025-6020.

• securitymediumbinutils security updates

  binutils was updated with fixes for CVE-2025-5244, CVE-2025-5245, and CVE-2025-8225.

• securitymediumcoreutils security update

  coreutils was updated with a fix for CVE-2025-5278.

• securitymediumlibpcre2 security update

  libpcre2 was updated with a fix for CVE-2025-58050.

• securitymediumnet-tools security update

  net-tools was updated with a fix for CVE-2025-46836.

• securitylowopenssh security updates

  openssh was updated with fixes for CVE-2025-61984 and CVE-2025-61985.

• securitylibxml2 update

  libxml2 was updated to libxml2-20250908.

• breakingOpenSSH algorithm configuration defaults

  Ciphers, MACs, and KexAlgorithms were dropped from the sshd configuration. OpenSSH upstream defaults are used instead.

• breakingReduced first-stage initrd kernel modules

  The set of kernel modules available in the first initrd is reduced.

Action needed (1)

• breakingThe blocks storage bucket index default

  Blocks storage now enables the bucket index by default through -blocks-storage.bucket-store.bucket-index.enabled. Disabling it with -blocks-storage.bucket-store.bucket-index.enabled=false is not recommended for production.

Action needed (1)

• securityhighnghttp2 **CVE-2026-27135** patch

  The nghttp2 **CVE-2026-27135** patch is included.

Action needed (12)

• securitycriticalCVE-2025-68121 fix

  This release fixes CVE-2025-68121.

• securitycriticalCVE-2026-33186 fix

  This release fixes CVE-2026-33186.

• securityhighCVE-2026-24051 fix

  This release fixes CVE-2026-24051 in the 1.16 release line.

• securityhighThe github.com/docker/cli dependency update

  The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.

• securityhighCVE-2025-66564 fix

  This release resolves CVE-2025-66564.

• securitymediumThe sigstore/rekor dependency update to v1.5.1

  The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.

• securitymediumThe go-tuf/v2 dependency update to v2.3.1

  The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.

• securitymediumCVE-2026-22772 fix

  This release fixes CVE-2026-22772.

• securitymediumThe go-tuf/v2 dependency update to v2.4.1

  The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.

• securitylowCVE-2026-1229 fix

  This release fixes CVE-2026-1229 in the 1.16 release line.

• securitylowCVE-2026-26958 fix

  This release fixes CVE-2026-26958.

• securityStandard library CVE fixes

  This release fixes standard library CVEs.

Action needed (6)

• securitycriticalCVE-2026-33186 correction

  The release fixes CVE-2026-33186.

• securityhighCVE-2026-24051 correction

  The release fixes CVE-2026-24051 in the 1.17 release line.

• securityhighCVE-2026-34986 correction

  The release fixes CVE-2026-34986.

• securitylowCVE-2026-1229 correction

  The release fixes CVE-2026-1229.

• securityCVES 2026-15558 correction

  The release includes the CVES 2026-15558 fix for 1.17.

• securityGo version update

  The Go version was bumped to fix standard library CVEs.

Action needed (11)

• breakingStrictIPCIDRValidation enabled by default

  The StrictIPCIDRValidation feature gate in kube-apiserver is enabled by default.

• breakingThe default debug profile, changed to general

  The default debug profile changes from legacy to general.

• breakingWatchCacheInitializationPostStartHook enabled by default

  The WatchCacheInitializationPostStartHook feature gate is enabled by default.

• breakingKubeletPSI graduation to GA

  The KubeletPSI feature graduated to GA and is enabled by default.

• breakingRelaxedServiceNameValidation at beta, enabled by default

  The RelaxedServiceNameValidation feature gate graduated to beta and is enabled by default.

• breakingRestartAllContainersOnContainerExits at beta, enabled by default

  The RestartAllContainersOnContainerExits feature gate graduated to beta and is enabled by default.

• breakingSuspended-job feature gates enabled by default

  The MutablePodResourcesForSuspendedJobs and MutableSchedulingDirectivesForSuspendedJobs feature gates are enabled by default.

• breakingAtomicFIFO informer store updates

  Default informer behavior now updates store state with all objects in a list or relist before invoking individual-item handler methods. This behavior is associated with AtomicFIFO.

• breakingUnlockWhileProcessing informer behavior

  Informers can now enqueue new watch events while already-queued events are being processed. This behavior is associated with UnlockWhileProcessing.

• breakingClientsAllowCARotation functionality enabled by default

  This functionality is enabled by default and can be disabled through the ClientsAllowCARotation feature gate.

• breakingClientsAllowTLSCacheGC functionality enabled by default

  This functionality is enabled by default and can be controlled through the ClientsAllowTLSCacheGC feature gate.

Action needed (1)

• securitycriticalGo 1.26.2 build with security fixes

  The release is built with Go 1.26.2, which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Check if affected (1)

• breakingRequired audience field on the GCR Receiver secret

  Applies if you configure the audience field on the GCR Receiver secret.

Check if affected (2)

• securityhighCVE-2026-41246 fix for cookieRewritePolicies[].pathRewrite.value

  Applies if you use HTTPProxy resources.

• breakingEnvoy 1.35.0 minimum version

  Applies if you depend on Envoy.

Check if affected (1)

• breakingConfiguration schema values replaced

  Applies if you use existing extensions and blueprints.

Check if affected (1)

• breakingDefault for MaxUnavailableStatefulSet

  Applies if you do not enable MaxUnavailableStatefulSet.

Action needed (1)

• securityThe Go version update

  The Go version is updated from 1.25.8 to 1.25.9 in v1.16.13.

Action needed (4)

• securityhighThe glob and rollup dependencies, upgraded

  The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.

• securityThe glob dependency, upgraded to v13

  The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.

• securityThe rollup dependency, upgraded to v4.59+

  rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.

• securityThe .well-known/oauth-protected-resource URL

  The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (3)

• securityQueue subscription enforcement of ACL deny patterns

  Applies if you use queue subscriptions and configure non-queue ACL deny patterns.

• breakingThe no_auth_user configuration field, restricted to client connections

  Applies if you configure no_auth_user.

• breakingDuplicate INFO permission updates for solicited leaf connections

  Applies if you use solicited leaf connections.

Check if affected (2)

• breakingThe no_auth_user connection scope restriction

  Applies if you configure no_auth_user.

• breakingThe INFO permission update restriction

  Applies if you use solicited leaf connections.

Action needed (1)

• breakingThe default chart tag is removed

  The default tag is removed, so the chart uses chart.yaml's appVersion.

Action needed (6)

• securitySeparate password and OTP brute force protection

  Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.

• securityResourceAdminManager URL construction validation

  URL construction in ResourceAdminManager is validated against matrix parameter injection.

• securityClient retrieval anti-ID phishing check

  Client retrieval now includes the missing anti-ID phishing check.

• breakingZero-downtime patch releases enabled by default

  Zero-downtime patch releases are now promoted to supported and enabled by default.

• breaking--truststore-kubernetes-enabled enabled by default

  The behavior controlled by --truststore-kubernetes-enabled is enabled by default.

• breakingTen-second default not-before validation

  The default not-before validation period is now 10 seconds instead of 0.

Action needed (1)

• securitymediumBatchCheck policy enforcement fix for CVE-2026-34972

  The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

• breakingThe storage.tsdb.retention.time unit handling

  Applies if you configure storage.tsdb.retention.time.

Check if affected (1)

• breakingFractional pseudorandom bucketing assignments

  Applies if you use providers.

Action needed (1)

• securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution

  The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (5)

• breakingGo support in CDH removed

  Applies if you use CDH.

• breakingCanonical TDX Tech preview support removed

  Applies if you use Canonical TDX Tech preview.

• breakingUbuntu version requirement

  Applies if you use Ubuntu 24.04.4 (linux-image-generic-hwe-24.04) or 25.10.

• + 2 more on the release page

Action needed (1)

• securityDependency and Python interpreter updates for CVE fixes

  Many dependencies and the Python interpreter were updated to resolve CVEs.

Check if affected (1)

• breakingCustom HTTPAuthPlugin lifecycle contract

  Applies if you use custom HTTPAuthPlugin implementations.

Check if affected (1)

• breakingEventEngine defaults and fork support

  Applies if you use Python or Ruby.

Action needed (2)

• securityGo package updates for vulnerability fixes

  Go packages are upgraded to fix vulnerabilities.

• securityUI package updates for vulnerability fixes

  UI packages are upgraded to fix vulnerabilities.

Check if affected (1)

• breakingThe nodes/proxy RBAC grant, removed

  Applies if you use nodes/proxy.

Check if affected (7)

• breakingNetwork attachment definition get permissions in the virt-controller ClusterRole, removed

  Applicability is not stated in the release notes.

• breakingStop requests for paused VMIs, rejected

  Applies if you run paused VMIs.

• breakingThe EnableVirtioFsConfigVolumes feature, graduated to GA

  Applies if you use the EnableVirtioFsConfigVolumes feature gate.

• + 4 more on the release page

Action needed (1)

• breakingJWT size limit

  JWTs now have a 1MB size limit.