Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Vitessv22.0.4Storage & DataFeb 27, 2026

CHECK 2OTHER 14View full analysis

A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.

Check if affected (2)

securitycriticalBackup restore path traversal protection
Applies if you use backup storage.
securityhighManifest-based external decompression default, changed
Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.

Source ↗

Vitessv23.0.3Storage & DataFeb 27, 2026

CHECK 2OTHER 12View full analysis

A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.

Check if affected (2)

securityLoading compressor commands from MANIFEST, opt-in
Applies if you use --external-decompressor-use-manifest.
securityPath traversal through backup MANIFEST on restore blocked
Applies if backupengine runs.

Source ↗

Keycloak26.5.4SecurityFeb 20, 2026

ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
+ 1 more on the release page

Source ↗

Istio1.28.4Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config.Clone with mutations or Config.GetConfigForClient.
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
+ 1 more on the release page

Source ↗

Istio1.27.6Networking & MessagingFeb 10, 2026

ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.

Source ↗

Backstagev1.47.3CI/CD & App DeliveryFeb 2, 2026

CHECK 1View full analysis

A security-focused release with fixes for the TechDocs Node plugin. The release is relevant to deployments that use @backstage/plugin-techdocs-node.

Check if affected (1)

securitySecurity fixes for @backstage/plugin-techdocs-node
Applies if you use @backstage/plugin-techdocs-node.

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.

Source ↗

Longhornv1.10.2Storage & DataJan 28, 2026

CHECK 2OTHER 23View full analysis

A maintenance release includes a hotfixed operator image, a security-relevant DNS query correction, and fixes across volume, replica, CSI, and management paths. It also adds namespace inheritance for longhorn-share-manager in FastFailover mode.

Check if affected (2)

securityThe instance-manager DNS query behavior
Applies if you do not use a hard or solid state disk.
breakingThe backing-image-manager:v1.10.2 image, replaced with backing-image-manager:v1.10.2-hotfix-1
Applies if you use backing-image-manager:v1.10.2.

Source ↗

Kyvernov1.15.3SecurityJan 27, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with security-related fixes for the Go toolchain and cross-namespace access through apiCall. It also contains ordinary defect fixes and capability or behavior changes.

Action needed (1)

securityThe go version update for standard library CVEs
The go version is updated to fix standard library CVEs in this release.

Check if affected (1)

securityCross-namespace access through apiCall prevented
Applies if you use apiCall.

Source ↗

Dragonflyv2.4.1Storage & DataJan 23, 2026

CHECK 2View full analysis

A maintenance release that removes deprecated preheat API endpoints and fixes unauthenticated access to the Dragonfly manager job API. Both changes affect users of the corresponding APIs.

Check if affected (2)

securityDragonfly manager job API unauthenticated access fix
Applies if you use Dragonfly manager job API.
breakingDeprecated preheat API endpoints removed
Applies if you use deprecated preheat API endpoints.

Source ↗

CoreDNSv1.14.1Kubernetes CoreJan 16, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A security-focused maintenance release addresses disclosed Go vulnerabilities and improves proxy connection-pool performance. It also adds the forward plugin's max_idle_conns parameter, which defaults to 0 for an unbounded pool.

Action needed (1)

securityhighCVE-2025-68119 fix
The release also addresses CVE-2025-68119, which affects the stated Go versions.

Check if affected (1)

securitycriticalGo security vulnerability fixes
Applicability is not stated in the release notes.

Source ↗

Keycloak26.5.1SecurityJan 14, 2026

CHECK 1OTHER 13View full analysis

Keycloak 26.5.1 is a maintenance release with a security fix in the Organization feature. It also contains correctness fixes, a performance improvement, and changes to HTTP responses and realm administration.

Check if affected (1)

securityThe Organization feature account-name exposure fix
Applies if you use the Organization feature.

Source ↗

Keycloak26.5.0SecurityJan 6, 2026

CHECK 2PLAN 1OTHER 247View full analysis

A substantial feature and maintenance release adds operator capabilities including workflows, JWT authorization grants, organization invitations, OpenTelemetry export, and Windows services. It also updates Quarkus and fixes correctness issues, while changing supported database versions and addressing a vulnerability in brute force detection settings.

Check if affected (2)

securityBrute force detection settings vulnerability, corrected
Applies if you configure brute force detection settings.
breakingPostgreSQL 13.x support removal
Applies if you depend on PostgreSQL 13.x.

Plan ahead (1)

deprecatedFine-Grained Admin Permissions v1, deprecated
Applies if you enable admin/fine-grained-permissions.

Source ↗

← NewerFeb 27, 2026 – Jan 6, 2026

Browse by month