Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Kyvernov1.16.4SecurityApr 23, 2026

ACTION 12CHECK 3OTHER 2View full analysis

A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.

Action needed (12)

securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github.com/docker/cli dependency update
The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.5.1
The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.3.1
The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.4.1
The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.

Check if affected (3)

securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
securityCVE fixes for go < 1.25.8
Applies if you depend on go < 1.25.8.
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.

Source ↗

Kyvernov1.17.2SecurityApr 23, 2026

ACTION 6CHECK 2OTHER 17View full analysis

A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.

Action needed (6)

securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.

Check if affected (2)

securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.

Source ↗

Contourv1.33.4Networking & MessagingApr 20, 2026

CHECK 2OTHER 2View full analysis

A release with a fix for Lua code injection, a required Envoy version change, and an Envoy dependency update. It is tested against Kubernetes 1.32 through 1.34.

Check if affected (2)

securityhighCVE-2026-41246 fix for cookieRewritePolicies[].pathRewrite.value
Applies if you use HTTPProxy resources.
breakingEnvoy 1.35.0 minimum version
Applies if you depend on Envoy.

Source ↗

Contourv1.31.6Networking & MessagingApr 20, 2026

CHECK 1OTHER 2View full analysis

This release fixes a Lua code injection vulnerability in Contour's Cookie Rewriting feature and updates Envoy to v1.34.14. It is tested against Kubernetes 1.30 through 1.32.

Check if affected (1)

securityhighLua code injection fix for CVE-2026-41246
Applies if you configure cookieRewritePolicies[].pathRewrite.value.

Source ↗

containerdv2.0.8Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).

Source ↗

containerdv2.1.7Kubernetes CoreApr 14, 2026

ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub.com/moby/spdystream v0.5.1 update
The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if pod events are used.

Source ↗

containerdv1.7.31Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securitySanitized gRPC errors in pod events
Applies if you use pod events.

Source ↗

NATSv2.12.7Networking & MessagingApr 14, 2026

CHECK 3OTHER 15View full analysis

A maintenance release with a dependency and toolchain update, configuration constraint changes, performance improvements, and correctness fixes. It also fixes an ACL permission bypass along with issues affecting leaf connections, streams, storage, and client authentication.

Check if affected (3)

securityQueue subscription enforcement of ACL deny patterns
Applies if you use queue subscriptions and configure non-queue ACL deny patterns.
breakingThe no_auth_user configuration field, restricted to client connections
Applies if you configure no_auth_user.
breakingDuplicate INFO permission updates for solicited leaf connections
Applies if you use solicited leaf connections.

Source ↗

Prometheusv3.11.2ObservabilityApr 13, 2026

CHECK 1OTHER 2View full analysis

Release v3.11.2 fixes stored XSS in the Prometheus web UI and changes Consul service-discovery filtering. The Consul updates add health_filter support and correct how filter parameters are applied to the Health API.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI, CVE-2026-40179
Applies if you use the Prometheus web UI.

Source ↗

Prometheusv3.5.2ObservabilityApr 13, 2026

CHECK 1OTHER 1View full analysis

Prometheus v3.5.2 fixes a stored XSS vulnerability in the Prometheus web UI. The release also includes a regex performance improvement.

Check if affected (1)

securitymediumStored XSS fix in the Prometheus web UI
Applies if crafted metric names or label values can reach the Prometheus web UI.

Source ↗

OpenFGAv1.14.1SecurityApr 10, 2026

CHECK 2OTHER 3View full analysis

A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.

Check if affected (2)

securityAuthZEN discovery metadata endpoint URLs
Applies if authzen.baseURL is configured.
securityThe github.com/docker/docker test dependency, replaced with Moby
Applies if tests run.

Source ↗

Helmv3.20.2Kubernetes CoreApr 9, 2026

CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.

Source ↗

Helmv4.1.4Kubernetes CoreApr 9, 2026

ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

securityhighPlugin verification when .prov is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.

Source ↗

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.

Source ↗

Limav2.1.1Kubernetes CoreApr 3, 2026

CHECK 1OTHER 4View full analysis

A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.

Check if affected (1)

securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.

Source ↗

Keycloak26.5.7SecurityApr 2, 2026

ACTION 1CHECK 6OTHER 2View full analysis

A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.

Action needed (1)

securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io.vertx/vertx-core static handler component cache that could deny access to static files.

Check if affected (6)

securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
+ 3 more on the release page

Source ↗

NATSv2.12.6Networking & MessagingMar 24, 2026

ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

breakingJWT size limit
JWTs now have a 1MB size limit.

Check if affected (13)

securityhighMQTT security fixes
Applies if you use MQTT.
securityhighLeafnode security fix
Applies if you use leafnodes.
securityhighCommand-line credential security fix
Applies if you provide credentials on the command line.
+ 10 more on the release page

Source ↗

NATSv2.11.15Networking & MessagingMar 24, 2026

ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

breakingThe JWT size limit
JWTs now have a 1MB size limit.

Check if affected (11)

securityhighCVE-2026-33216, CVE-2026-33217, and CVE-2026-33215 fixes for MQTT systems
Applies if you use MQTT.
securityhighCVE-2026-33218 fix for leafnodes
Applies if you use leafnodes.
securityhighCVE-2026-33247 fix for command-line credentials
Applies if you configure credentials on the command line.
+ 8 more on the release page

Source ↗

OpenFGAv1.13.1SecurityMar 24, 2026

CHECK 1View full analysis

A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.

Check if affected (1)

securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed
Applies if Check requests use conditions and caching is enabled.

Source ↗

Ciliumv1.19.2Networking & MessagingMar 23, 2026

CHECK 2OTHER 46View full analysis

A maintenance release with operator-relevant bug fixes, new configuration and diagnostic capabilities, and dependency and image updates. Two fixes address security-relevant exposure or policy bypass, and no deprecations or removals are announced.

Check if affected (2)

securityWorld-accessible Envoy admin socket
Applies if envoy runs.
securityIngress policy enforcement for local backends
Applies if you use ingress policies and local backends.

Source ↗

Ciliumv1.17.14Networking & MessagingMar 23, 2026

CHECK 1OTHER 21View full analysis

A maintenance release with bug fixes, dependency and image updates, improved bugtool output, and a GKE channel fix. The Envoy admin socket fix addresses its world-accessible creation.

Check if affected (1)

securityThe Envoy admin socket's accessibility
Applies if Envoy runs.

Source ↗

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.

Source ↗

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.

Source ↗

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

Source ↗

Keycloak26.5.6SecurityMar 19, 2026

CHECK 8OTHER 10View full analysis

A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.

Check if affected (8)

securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration
Applies if you use OIDC Dynamic Client Registration.
securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion
Applicability is not stated in the release notes.
securitymediumCVE-2026-3121, privilege escalation via manage-clients permission
Applies if you configure manage-clients permission.
+ 5 more on the release page

Source ↗

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.

Source ↗

Envoyv1.37.1Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.

Source ↗

Envoyv1.36.5Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.

Source ↗

Istio1.29.1Networking & MessagingMar 10, 2026

ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-26311 HTTP decode method restriction
Applies if you use HTTP.
+ 7 more on the release page

Source ↗

Istio1.28.5Networking & MessagingMar 10, 2026

ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

securityhighCVE-2026-26308 multivalue header bypass fix in RBAC
CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method fix
CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write in Istio.
securitymediumCVE-2026-26330 ratelimit response phase crash fix
CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

securityAuthentication for XDS debug endpoints on port 15010
Applies if you expose XDS debug endpoints.
securityBearer token realm URL validation for WasmPlugin image fetching
Applies if you use WasmPlugin image fetching.
securityNamespace-based authorization for HTTP debug endpoints on port 15014
Applies if you expose HTTP debug endpoints.

Source ↗

Istio1.27.8Networking & MessagingMar 10, 2026

ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

securitymediumCVE-2026-26311 HTTP decode method correction
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix
Applies if you use Debug Endpoints.
+ 3 more on the release page

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
+ 1 more on the release page

Source ↗

NATSv2.12.5Networking & MessagingMar 9, 2026

CHECK 3OTHER 65View full analysis

A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.

Check if affected (3)

securityCVE-2026-29785 fix for leafnode compression
Applies if leafnode compression is enabled.
securityCVE-2026-27889 fix for WebSockets
Applies if WebSockets are enabled.
breakingThe max_conns server configuration value
Applies if you configure max_conns in the server configuration.

Source ↗

NATSv2.11.14Networking & MessagingMar 9, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.

Check if affected (2)

securityhighCVE-2026-29785 fix for leafnode compression
Applies if CVE-2026-29785 is present and leafnode compression is enabled.
securityhighCVE-2026-27889 fix for WebSockets
Applies if CVE-2026-27889 is present and WebSockets is enabled.

Source ↗

CoreDNSv1.14.2Kubernetes CoreMar 6, 2026

ACTION 1CHECK 2OTHER 7View full analysis

A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.

Action needed (1)

securityhighThe Go 1.26.1 build dependency and cited security fixes
The build uses Go 1.26.1, which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.

Check if affected (2)

securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.

Source ↗

Keycloak26.5.5SecurityMar 5, 2026

CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
+ 1 more on the release page

Source ↗

Backstagev1.48.4CI/CD & App DeliveryMar 4, 2026

CHECK 1View full analysis

Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.

Check if affected (1)

securitySecurity fixes for three Backstage packages
Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.

Source ↗

SPIREv1.14.2SecurityMar 3, 2026

CHECK 2View full analysis

Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.

Check if affected (2)

securityThe http_challenge server node attestor plugin, SSRF issue fixed
Applies if you use http_challenge.
securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed
Applies if you use x509pop.

Source ↗

SPIREv1.13.4SecurityMar 3, 2026

CHECK 2View full analysis

A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.

Check if affected (2)

securityThe http_challenge server node attestor plugin, SSRF issue corrected
Applies if you use the http_challenge server node attestor plugin.
securityThe x509pop server node attestor plugin, CPU consumption issue corrected
Applies if you use the x509pop server node attestor plugin.

Source ↗

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.

Source ↗

← NewerApr 23, 2026 – Feb 27, 2026Older →

Browse by month