Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Prometheusv3.5.4ObservabilityJun 17, 2026

ACTION 2CHECK 1OTHER 1View full analysis

Prometheus v3.5.4 is primarily a security maintenance release, with a fix for plaintext secret exposure and dependency updates addressing reported advisories. It also adds publication of container images to the GitHub Container Registry at ghcr.io.

Action needed (2)

securitycriticalgolang.org/x/net and OpenTelemetry dependency updates
The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.
securityPatched UI dependency versions
The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Check if affected (1)

securityPlaintext secret exposure via /-/config corrected
Applies if you access the /-/config endpoint.

OpenFGAv1.18.0SecurityJun 17, 2026

CHECK 3View full analysis

v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.

Check if affected (3)

securitymediumMySQL schema migrations 008
Applies if you use the MySQL backend.
securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
securityRequired OIDC issuer and audience configuration
Applies if authn.method is set to oidc.

Ciliumv1.19.5Networking & MessagingJun 16, 2026

CHECK 3OTHER 48View full analysis

A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.

Check if affected (3)

securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
breakingThe loadBalancer.standalone Helm option, removed
Applies if you configure loadBalancer.standalone.
breakingThe l2podAnnouncements.interface Helm value, replaced by l2podAnnouncements.interfacePattern
Applies if you configure l2podAnnouncements.interface and enable L2 pod announcements.

KServev0.19.0AI & MLJun 14, 2026

ACTION 1CHECK 3OTHER 44View full analysis

A release with operator-facing additions and fixes, including new LLMInferenceService capabilities and status observability. It also updates dependencies and images and includes security-related fixes.

Action needed (1)

securityhighazure-core pinned for CVE-2026-21226
The azure-core dependency is pinned to >=1.38.0 to address CVE-2026-21226.

Check if affected (3)

securityvllm setup and pillow dependency fixes
Applies if you depend on vllm or pillow.
breakingIncorrect CRDs removed from llmisvc-crd
Applies if you use llmisvc-crd.
breakingHelm imagePullPolicy defaults
Applies if you use Helm.

Daprv1.18.0Orchestration & ManagementJun 10, 2026

ACTION 8CHECK 6PLAN 1OTHER 108View full analysis

A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.

Action needed (8)

securitymediumThe golang.org/x/image dependency update for GO-2026-4962
golang.org/x/image is updated to v0.39.0 for GO-2026-4962.
securityThe durabletask-go and pgx dependency updates
durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.
breakingThe WorkflowsRemoteActivityReminder default, enabled
WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.
breakingThe HotReload default, enabled
HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.
breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe HotReload default, enabled in v1.18
HotReload is enabled by default in v1.18.
breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (6)

securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed
Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.
breakingThe Sentry Ed25519 workload identity key rollback constraint
Applicability is not stated in the release notes.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated
Applies if you use ScheduleJobAlpha1.

Cortexv1.21.1ObservabilityJun 5, 2026

CHECK 3OTHER 7View full analysis

A maintenance release with operator-facing security fixes and configuration changes across ingestion, distribution, and status pages. It also includes fixes for request handling, authentication, configuration exposure, gossip limits, and client and runtime panics.

Check if affected (3)

securityStored XSS protection in Alertmanager and Store Gateway status pages
Applies if you run Alertmanager or Store Gateway.
securityWrappedHistogram native histogram size limit
Applies if you use native histograms.
breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion
Applies if you use the OTLP ingestion path.

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Keycloak26.6.3SecurityJun 4, 2026

ACTION 2CHECK 15OTHER 30View full analysis

A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.

Action needed (2)

securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Check if affected (15)

securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
+ 12 more on the release page

Envoyv1.37.3Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

securityhighnghttp2 CVE-2026-27135 patch
The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

securityhighHTTP/2 header list limits and cookie accounting
Applies if you use HTTP/2.
securityOAuth2 HMAC verification timing
Applies if you use oauth2.

Envoyv1.36.7Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 with configured header list or request-header limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use the OAuth2 filter.

Envoyv1.35.11Networking & MessagingJun 3, 2026

ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

securityhighHTTP/2 header limits and cookie accounting
Applies if you use HTTP/2 request header limits.
securityOAuth2 HMAC verification timing protection
Applies if you use OAuth2 HMAC verification.

KEDAv2.20.0Orchestration & ManagementJun 1, 2026

CHECK 7PLAN 1OTHER 70View full analysis

This release adds scalers, configuration options, metrics, authentication modes, and compatibility improvements. Operators with custom RBAC need to account for the Kubernetes events API migration, and users of removed scaler settings need to update their configurations.

Check if affected (7)

securityCredential headers on cross-host redirects and HTTPS downgrades
Applicability is not stated in the release notes.
breakingScaledObject name length validation
Applies when a ScaledObject name exceeds 63 characters.
breakingPositive unprocessedEventThreshold values
Applies if you configure a non-positive unprocessedEventThreshold.
+ 4 more on the release page

Plan ahead (1)

deprecatedThe buildId, selectAllActive, and selectUnversioned settings, deprecated
Applies if you configure buildId, selectAllActive, or selectUnversioned.

Kubescapev4.0.9SecurityMay 29, 2026

ACTION 3CHECK 3OTHER 105View full analysis

A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.

Action needed (3)

securityDependency updates for security advisories
Dependencies are updated to address security advisories.
securityEnvFrom clearing in container data removal
removeContainersData now clears EnvFrom to prevent secret name leakage.
securityEnv[].ValueFrom clearing in container data removal
removeContainersData and removeEphemeralContainersData now clear Env[].ValueFrom.

Check if affected (3)

security/v1/results access control hardening
Applies if you use /v1/results.
breakingThe pdf/html output default changed to file output
Applies if you use pdf/html output.
breakingThe push default changed to opt-in
Applies if you use push.

Daprv1.17.8Orchestration & ManagementMay 28, 2026

CHECK 1OTHER 1View full analysis

A maintenance release corrects a workflow retentioner defect and constrains forwarded-host handling during Sentry OIDC discovery. The discovery change affects deployments that use Sentry OIDC.

Check if affected (1)

securityConstrained X-Forwarded-Host use during Sentry OIDC discovery
Applies if you use Sentry OIDC.

SPIREv1.15.1SecurityMay 28, 2026

CHECK 1OTHER 2View full analysis

SPIRE v1.15.1 includes a security correction for Azure IMDS node attestation. The release also updates the golang.org/x/net and golang.org/x/crypto dependencies.

Check if affected (1)

securityAzure IMDS node attestation validation
Applies if you use the azure_imds server node attestor plugin.

SPIREv1.14.7SecurityMay 28, 2026

CHECK 1OTHER 2View full analysis

SPIRE v1.14.7 fixes a security vulnerability in Azure IMDS node attestation. It also updates the Go toolchain to 1.26.3 and updates three dependencies.

Check if affected (1)

securityThe azure_imds node attestor validation is corrected
Applies if you use the azure_imds server node attestor plugin.

Contourv1.33.5Networking & MessagingMay 28, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for invalid HTTPProxy configurations and an update to golang.org/x/net. It also updates the Go toolchain to 1.25.10 and is tested against Kubernetes 1.32 through 1.34.

Action needed (1)

securitycriticalgolang.org/x/net updated to v0.55.0, CVE-2026-39821
Contour v1.33.5 updates golang.org/x/net to v0.55.0. The change addresses CVE-2026-39821.

Check if affected (1)

securitymediumInvalid HTTPProxy configuration rejected, GHSA-g3xr-5w5j-w4q4
Applies if you configure HTTPProxy with a fallback certificate and enable JWT verification.

Prometheusv3.12.0ObservabilityMay 28, 2026

ACTION 1CHECK 3OTHER 45View full analysis

A feature and maintenance release with new operator-facing APIs, discovery integrations, feature flags, configuration options, and UI capabilities. It also addresses disclosed security issues, correctness and performance problems, and validation or constraint behavior.

Action needed (1)

breakingConcurrent fgprof profile rejection
The API rejects concurrent fgprof profiles.

Check if affected (3)

securityRemote Write decoded-length constraint
Applies if you use Remote Write.
securityPlaintext secret exposure in STACKIT SD
Applies if you use STACKIT SD.
breakingDecompressed body-size limit for OTLP write requests
Applies if you use OTLP.

Argov3.4.3CI/CD & App DeliveryMay 28, 2026

CHECK 1OTHER 8View full analysis

A maintenance release with several correctness fixes across Argo CD and a UI dependency update addressing CVE-2026-41240. The recorded fixes cover CLI, UI, Git, controller startup, and resource handling.

Check if affected (1)

securitymediumThe redoc/dompurify dependency, upgraded for CVE-2026-41240
Applies if you use redoc/dompurify in /ui.

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

Crossplanev2.3.1Orchestration & ManagementMay 22, 2026

ACTION 1CHECK 13OTHER 1View full analysis

A maintenance release includes dependency updates and security fixes in golang.org/x/crypto. The fixes cover SSH, SSH agent, and known-hosts behavior.

Action needed (1)

securitygolang.org/x/crypto updated to v0.52.0
The release updates the golang.org/x/crypto module to v0.52.0.

Check if affected (13)

securitycriticalUnenforced invoking key constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalDropped invoking agent constraints in golang.org/x/crypto/ssh/agent
Applies if you use golang.org/x/crypto/ssh/agent.
securitycriticalServer deadlock on unexpected responses in golang.org/x/crypto/ssh
Applies if you use golang.org/x/crypto/ssh.
+ 10 more on the release page

Crossplanev2.1.6Orchestration & ManagementMay 22, 2026

ACTION 6CHECK 1OTHER 1View full analysis

A security-focused maintenance release updates Go and several dependencies, including a fix for an HTTP/2 transport infinite-loop vulnerability. The Go and dependency version increases require upgrading; no configuration migration or deprecation is announced.

Action needed (6)

securityThe go.opentelemetry.io/otel module update
The go.opentelemetry.io/otel module is updated to v1.41.0 in this release.
securityThe github.com/in-toto/in-toto-golang module update
The github.com/in-toto/in-toto-golang module is updated to v0.11.0 in this release.
securityThe github.com/go-git/go-git/v5 module update to v5.19.0
The github.com/go-git/go-git/v5 module is updated to v5.19.0 in this release.
securityGo 1.25.10
Go is updated to 1.25.10 to fix standard library CVEs.
securityThe github.com/go-git/go-git/v5 module update to v5.19.1
The github.com/go-git/go-git/v5 module is updated to v5.19.1 in this release.
securityThe golang.org/x/crypto module update
The golang.org/x/crypto module is updated to v0.52.0 in this release.

Check if affected (1)

securityhighThe golang.org/x/net HTTP/2 transport infinite loop
Applicability is not stated in the release notes.

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
+ 1 more on the release page

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
+ 9 more on the release page

Istio1.29.3Networking & MessagingMay 18, 2026

ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump
Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

securityRegex handling in AuthorizationPolicy identity fields
Applicability is not stated in the release notes.
breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes
Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).

Istio1.28.7Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.

Action needed (1)

securitySame-namespace authorization for StatusGen XDS debug endpoints
The StatusGen-served XDS debug endpoints istio.io/debug/syncz and istio.io/debug/config_dump now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.

Check if affected (1)

securityEscaped regex metacharacters in AuthorizationPolicy identity fields
Applies if you configure source.principals or source.namespaces.

Helmv4.2.0Kubernetes CoreMay 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394
Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

securityPlugin version path traversal fix
Applies if you use the Plugin extension.

Plan ahead (1)

deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.

Volcanov1.12.4Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for a disclosed denial-of-service vulnerability in the webhook server, plus ordinary scheduling bug fixes. The vulnerability affects webhook servers that accept unbounded HTTP request bodies.

Check if affected (1)

securitymediumCVE-2026-44247 in the Volcano webhook server
Applies if the Volcano webhook server runs.

Volcanov1.13.3Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 4View full analysis

Volcano v1.13.3 includes a security fix for a denial-of-service vulnerability in the webhook server. It also contains other defect corrections.

Check if affected (1)

securitymediumCVE-2026-44247 in the Volcano webhook server
Applies if a pod can access the Volcano webhook endpoint over the network.

Volcanov1.14.2Orchestration & ManagementMay 9, 2026

CHECK 1OTHER 17View full analysis

A maintenance release fixes a disclosed webhook denial-of-service vulnerability and corrects scheduler, queue, and event-handling defects. It also updates the Kubernetes version used by the webhook-manager image.

Check if affected (1)

securitymediumCVE-2026-44247: Webhook server request body handling
Applies if the Volcano webhook server runs.

etcdv3.6.11Kubernetes CoreMay 1, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

securitymediumgolang.org/x/image update for GO-2026-4962
The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.

etcdv3.4.44Kubernetes CoreMay 1, 2026

CHECK 1OTHER 1View full analysis

A security maintenance release fixes an RBAC authorization bypass. It also updates the Go toolchain used to compile binaries to go 1.25.9.

Check if affected (1)

securityRBAC authorization bypass fix
Applies if you use RBAC.

Vitessv24.0.0Storage & DataApr 30, 2026

ACTION 3CHECK 12PLAN 4OTHER 244View full analysis

A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.

Action needed (3)

securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.

Check if affected (12)

securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
+ 9 more on the release page

Plan ahead (4)

deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
+ 1 more on the release page

Backstagev1.50.4CI/CD & App DeliveryApr 29, 2026

CHECK 1View full analysis

A security maintenance release with fixes affecting three Backstage catalog packages. The affected packages are @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, and @backstage/plugin-catalog-unprocessed-entities.

Check if affected (1)

securitySecurity fixes for Backstage catalog packages
Applies if you use any of @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, or @backstage/plugin-catalog-unprocessed-entities.

SPIREv1.14.6SecurityApr 27, 2026

CHECK 2View full analysis

A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.

Check if affected (2)

securityThe aws_iid attestation identity verification
Applies if you use the aws_iid server node attestor plugin.
securityJoin token data store deletion
Applicability is not stated in the release notes.

SPIREv1.13.6SecurityApr 27, 2026

CHECK 1OTHER 1View full analysis

This is a security and correctness fix release for SPIRE node attestation. It addresses forged EC2 identity handling in aws_iid and concurrent join-token attestation behavior.

Check if affected (1)

securityCorrected aws_iid EC2 identity verification
Applies if you use the aws_iid server node attestor plugin.

NATSv2.11.17Networking & MessagingApr 27, 2026

CHECK 2OTHER 7View full analysis

A maintenance release updates the Go toolchain and corrects NATS server defects. It includes fixes for bearer credential disclosure through monitoring and for redaction of route and cluster URL secrets.

Check if affected (2)

securityThe /connz endpoint no longer discloses bearer JWTs
Applies if you use the /connz monitoring endpoint.
securityMonitoring redaction of route and cluster URL secrets
Applies if you pass route and cluster URL secrets as command line arguments.

Prometheusv3.11.3ObservabilityApr 27, 2026

CHECK 3View full analysis

A security maintenance release with corrections for credential exposure, request decoding validation, and stored cross-site scripting. Advisory identifiers are provided for the addressed defects, and the fixes ship in this release.

Check if affected (3)

securityhighAzureAD remote write OAuth client_secret exposure fix
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use the old UI heatmap chart.

Prometheusv3.5.3ObservabilityApr 27, 2026

CHECK 4View full analysis

A security-focused release with fixes for exposed OAuth secrets and stored XSS. Remote read and write request validation now rejects snappy-compressed payloads whose declared decoded length exceeds the decode limit.

Check if affected (4)

securityhighAzureAD remote write client_secret exposure fixed
Applies if you use AzureAD remote write.
securityhighRemote-read decoded-length validation
Applies if you use Remote-read.
securitymediumOld UI heatmap chart le label escaping
Applies if you use UI.
+ 1 more on the release page

Envoyv1.38.0Networking & MessagingApr 23, 2026

ACTION 1CHECK 6PLAN 1OTHER 77View full analysis

A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.

Action needed (1)

securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.

Check if affected (6)

securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.

← NewerJun 17, 2026 – Apr 23, 2026Older →

Browse by month