RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Mar 2026Clear ×
NATSv2.12.6Networking & MessagingMar 24, 2026
ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

  • breakingJWT size limit

    JWTs now have a 1MB size limit.

Check if affected (13)

  • securityhighMQTT security fixes

    Applies if you use MQTT.

  • securityhighLeafnode security fix

    Applies if you use leafnodes.

  • securityhighCommand-line credential security fix

    Applies if you provide credentials on the command line.

  • + 10 more on the release page
Source ↗
NATSv2.11.15Networking & MessagingMar 24, 2026
ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

  • breakingThe JWT size limit

    JWTs now have a 1MB size limit.

Check if affected (11)

Source ↗
OpenFGAv1.13.1SecurityMar 24, 2026
CHECK 1View full analysis

A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.

Check if affected (1)

Source ↗
Ciliumv1.19.2Networking & MessagingMar 23, 2026
CHECK 2OTHER 46View full analysis

A maintenance release with operator-relevant bug fixes, new configuration and diagnostic capabilities, and dependency and image updates. Two fixes address security-relevant exposure or policy bypass, and no deprecations or removals are announced.

Check if affected (2)

  • securityWorld-accessible Envoy admin socket

    Applies if envoy runs.

  • securityIngress policy enforcement for local backends

    Applies if you use ingress policies and local backends.

Source ↗
Ciliumv1.17.14Networking & MessagingMar 23, 2026
CHECK 1OTHER 21View full analysis

A maintenance release with bug fixes, dependency and image updates, improved bugtool output, and a GKE channel fix. The Envoy admin socket fix addresses its world-accessible creation.

Check if affected (1)

  • securityThe Envoy admin socket's accessibility

    Applies if Envoy runs.

Source ↗
etcdv3.6.9Kubernetes CoreMar 20, 2026
ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

  • securitycriticalgoogle.golang.org/grpc updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413

    The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.

  • securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.

  • securityhighgolang.org/x/net updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

  • securitylowRBAC checks for nested etcd transactions, CVE-2026-33343

    Applies if you use nested etcd transactions and RBAC.

Source ↗
etcdv3.5.28Kubernetes CoreMar 20, 2026
ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

  • securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3

    The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.

  • securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0

    The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.

  • securityhighThe golang.org/x/net dependency, updated to v0.51.0

    The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

  • securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)

    Applies if you use unauthenticated endpoints.

  • securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)

    Applies if you use nested txn ops.

Source ↗
Daprv1.17.2Orchestration & ManagementMar 19, 2026
ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

  • securityhighGo toolchain upgrade to 1.25.8

    The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.

  • securitymediumGO-2026-4603 and escaped meta content URLs

    html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.

  • securitylowGO-2026-4602 and os.FileInfo root boundaries

    os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

  • securityhighGO-2026-4601 and IPv6 host literal parsing

    Applies if you use net/url.

  • breakingConfiguration stateRetentionPolicy schema

    Applies if you configure stateRetentionPolicy.

Source ↗
Keycloak26.5.6SecurityMar 19, 2026
CHECK 8OTHER 10View full analysis

A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.

Check if affected (8)

  • securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration

    Applies if you use OIDC Dynamic Client Registration.

  • securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion

    Applicability is not stated in the release notes.

  • securitymediumCVE-2026-3121, privilege escalation via manage-clients permission

    Applies if you configure manage-clients permission.

  • + 5 more on the release page
Source ↗
SPIREv1.14.3SecurityMar 18, 2026
ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

  • securityAgent-level selector logging removal

    Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

  • securityServer TCP endpoint TLS session tickets disabled

    Applies if you use the server TCP endpoint.

Source ↗
Envoyv1.37.1Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()

    The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix

    The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset

    HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

Source ↗
Envoyv1.36.5Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 json null terminator write fix

    Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 HTTP decoder reset handling

    Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

  • securityhighCVE-2026-26308 rbac multivalue header bypass fix

    Applies if you use rbac.

  • securitymediumCVE-2026-26330 ratelimit response phase limit crash fix

    Applies if you use ratelimit.

Source ↗
Istio1.29.1Networking & MessagingMar 10, 2026
ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

Source ↗
Istio1.28.5Networking & MessagingMar 10, 2026
ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

  • securityhighCVE-2026-26308 multivalue header bypass fix in RBAC

    CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.

  • securitymediumCVE-2026-26311 HTTP decode method fix

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write in Istio.

  • securitymediumCVE-2026-26330 ratelimit response phase crash fix

    CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.

  • securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix

    CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

  • securityAuthentication for XDS debug endpoints on port 15010

    Applies if you expose XDS debug endpoints.

  • securityBearer token realm URL validation for WasmPlugin image fetching

    Applies if you use WasmPlugin image fetching.

  • securityNamespace-based authorization for HTTP debug endpoints on port 15014

    Applies if you expose HTTP debug endpoints.

Source ↗
Istio1.27.8Networking & MessagingMar 10, 2026
ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

  • securitymediumCVE-2026-26311 HTTP decode method correction

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

Source ↗
cert-managerv1.20.0SecurityMar 10, 2026
ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

  • securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729

    Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.

  • breakingIssuer reference kind and group defaults, reverted

    The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

  • securityPotential cert-manager controller panic from cached DNS responses

    Applicability is not stated in the release notes.

  • breakingThe OtherNames feature, enabled by default

    Applies if you use the OtherNames feature.

  • breakingDefault container user and group IDs

    Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).

  • + 1 more on the release page
Source ↗
NATSv2.12.5Networking & MessagingMar 9, 2026
CHECK 3OTHER 65View full analysis

A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.

Check if affected (3)

  • securityCVE-2026-29785 fix for leafnode compression

    Applies if leafnode compression is enabled.

  • securityCVE-2026-27889 fix for WebSockets

    Applies if WebSockets are enabled.

  • breakingThe max_conns server configuration value

    Applies if you configure max_conns in the server configuration.

Source ↗
NATSv2.11.14Networking & MessagingMar 9, 2026
CHECK 2OTHER 7View full analysis

A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.

Check if affected (2)

  • securityhighCVE-2026-29785 fix for leafnode compression

    Applies if CVE-2026-29785 is present and leafnode compression is enabled.

  • securityhighCVE-2026-27889 fix for WebSockets

    Applies if CVE-2026-27889 is present and WebSockets is enabled.

Source ↗
CoreDNSv1.14.2Kubernetes CoreMar 6, 2026
ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

Check if affected (2)

  • securityhighThe rewrite and acl ordering, CVE-2026-26017

    Applies if you use both rewrite and acl.

  • securityhighplugin/loop query name generation, CVE-2026-26018

    Applies if plugin/loop runs.

Source ↗
Keycloak26.5.5SecurityMar 5, 2026
CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

  • securityhighCVE-2026-3047 SAML broker authentication bypass

    Applies if you use SAML broker and configure a disabled SAML client.

  • securityhighCVE-2026-3009 disabled identity provider enforcement

    Applies if you configure Disabled Identity Provider.

  • securityhighCVE-2026-2603 disabled SAML IdP broker login

    Applies if you configure Disabled SAML IdP.

  • + 1 more on the release page
Source ↗
Backstagev1.48.4CI/CD & App DeliveryMar 4, 2026
CHECK 1View full analysis

Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.

Check if affected (1)

  • securitySecurity fixes for three Backstage packages

    Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.

Source ↗
SPIREv1.14.2SecurityMar 3, 2026
CHECK 2View full analysis

Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue fixed

    Applies if you use http_challenge.

  • securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed

    Applies if you use x509pop.

Source ↗
SPIREv1.13.4SecurityMar 3, 2026
CHECK 2View full analysis

A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.

Check if affected (2)

  • securityThe http_challenge server node attestor plugin, SSRF issue corrected

    Applies if you use the http_challenge server node attestor plugin.

  • securityThe x509pop server node attestor plugin, CPU consumption issue corrected

    Applies if you use the x509pop server node attestor plugin.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023