Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KyvernoClear ×

Kyvernov1.19.0SecurityAug 20, 2026

ACTION 7CHECK 6PLAN 1OTHER 160View full analysis

A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.

Action needed (7)

securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated golang.org/x/crypto and x/net dependencies
The golang.org/x/crypto dependency was updated to v0.53.0 and x/net to v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.
securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
securitycel-go v0.30.0
cel-go was updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.

Check if affected (6)

breakingRequired --resource for the migrate command
Applies when the migrate command runs.
The migrate command now requires --resource. This constraint ships in Kyverno v1.19.0.
breakingDefault userInfo groups and UID during background scans
Applies when background scans run.
Background scans now default userInfo groups and UID for admission policies. The corrected defaults ship in Kyverno v1.19.0.
breakingexcludeBootstrapResources webhook flag
Applies when you configure Fail webhooks.
The webhook configuration adds the excludeBootstrapResources flag, which skips Node and CSR resources on Fail webhooks. The flag ships in Kyverno v1.19.0.
+ 3 more on the release page

Plan ahead (1)

deprecatedDeprecation notices for legacy kyverno.io policy types
Applies when you use legacy kyverno.io policy types.
Deprecation of legacy kyverno.io policy types is surfaced through warnings, a Helm notice, and the PSS default. This deprecation notice ships in Kyverno v1.19.0.

Source ↗

Kyvernov1.18.0SecurityApr 29, 2026

ACTION 4CHECK 2OTHER 102View full analysis

A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.

Action needed (4)

securityhighIntermediate certificate limit for CVE-2026-32280
Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.
securityhighGo toolchain upgraded to 1.26.2 for CVE-2026-32283
The Go toolchain is upgraded to 1.26.2 to fix CVE-2026-32283.
securitymediumgo-tuf/v2 upgraded to v2.4.1 for CVE-2026-24686
go-tuf/v2 is upgraded to v2.4.1 to fix CVE-2026-24686.
securityStandard library CVE fixes
Standard library CVEs are fixed in this release.

Check if affected (2)

breakingRestricted ConfigMap access for namespaced policies
Applies if you use namespaced policies.
Access to ConfigMap resources is restricted for namespaced policies in this release.
breakingFinalizers and uninstall workarounds removed
Applies if uninstall runs.
Finalizers and uninstall workarounds are removed in this release.

Source ↗

Kyvernov1.16.4SecurityApr 23, 2026

ACTION 12CHECK 3OTHER 2View full analysis

A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.

Action needed (12)

securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github.com/docker/cli dependency update
The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.5.1
The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.3.1
The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.4.1
The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.

Check if affected (3)

securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
HTTP is disabled by default in namespaced policies to address CVE-2026-4789.
securityCVE fixes for go < 1.25.8
Applies if you depend on go < 1.25.8.
This release resolves CVEs affecting go < 1.25.8.
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.
Access to configmap is restricted for namespaced policies.

Source ↗

Kyvernov1.17.2SecurityApr 23, 2026

ACTION 6CHECK 2OTHER 17View full analysis

A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.

Action needed (6)

securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.

Check if affected (2)

securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
HTTP is disabled by default in namespaced policies as a backport associated with CVE-2026-4789.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.
Access to configmap is restricted for namespaced policies.

Source ↗

Kyvernov1.17.1SecurityFeb 19, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.

Check if affected (1)

breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.
The default value and Helm values documentation now use a duration string instead of an integer.

Source ↗

Kyvernov1.17.0SecurityFeb 2, 2026

ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.

Check if affected (2)

breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
Resource access is restricted in namespaced CEL policy types in this release.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.
VAP/MAP reporting is opt in instead of opt out in this release.

Source ↗

Browse by month