Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: etcdClear ×

etcdv3.7.1Kubernetes CoreJul 23, 2026

ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

securityhighThe google.golang.org/grpc dependency update
The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.
breakingThe snapshotLimitByte default
The release sets a reasonable default value for snapshotLimitByte.
breakingThe client HTTP server ReadHeaderTimeout
The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

securityhighWatch responses restricted to authorized keys
Applicability is not stated in the release notes.
The watch permission issue covered by GHSA-xg4h-6gfc-h4m8 is fixed. A user granted read permission on one key no longer receives watch responses for every key starting from that key.

Source ↗

etcdv3.7.0Kubernetes CoreJul 8, 2026

ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

securityhighgolang.org/x/crypto updated to v0.52.0
The release updates golang.org/x/crypto to v0.52.0 to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.
The release fixes a CRL enforcement bypass on the gRPC listener when --listen-client-http-urls is configured. See advisory GHSA-3wh4-j44w-pg92 for details.

Source ↗

etcdv3.6.13Kubernetes CoreJul 1, 2026

ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0
The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang.org/x/crypto, updated to v0.52.0
The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.
This release fixes the CRL enforcement bypass on the gRPC listener when --listen-client-http-urls is configured. The fix addresses GHSA-3wh4-j44w-pg92.

Source ↗

etcdv3.5.32Kubernetes CoreJul 1, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.
The gRPC listener now enforces CRLs when --listen-client-http-urls is configured. This fixes GHSA-3wh4-j44w-pg92.

Source ↗

etcdv3.6.11Kubernetes CoreMay 1, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a correctness fix, an RBAC authorization bypass fix, and a security-related dependency update for GO-2026-4962. It also records Go 1.25.9 as the toolchain used to build the binaries.

Action needed (1)

securitymediumgolang.org/x/image update for GO-2026-4962
The release updates golang.org/x/image to v0.39.0 to resolve GO-2026-4962.

Check if affected (1)

securityRBAC authorization bypass in nested Put requests
Applies if you use RBAC.
The release fixes an RBAC authorization bypass that could allow read access through PrevKv or lease attachment in Put requests nested in etcd transactions.

Source ↗

etcdv3.4.44Kubernetes CoreMay 1, 2026

CHECK 1OTHER 1View full analysis

A security maintenance release fixes an RBAC authorization bypass. It also updates the Go toolchain used to compile binaries to go 1.25.9.

Check if affected (1)

securityRBAC authorization bypass fix
Applies if you use RBAC.
The RBAC authorization path is fixed for read access through PrevKv or lease attachment in Put requests nested in etcd transactions. The correction ships in this release.

Source ↗

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
The etcd server fixes RBAC authorization checks for nested etcd transactions. The issue is identified by CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Source ↗

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
Authentication checks now guard unauthenticated endpoints in v3.5.28, addressing authorization bypasses in multiple APIs (CVE-2026-33413).
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
Authentication checks now apply to nested etcd transactions in v3.5.28, addressing RBAC authorization bypasses (CVE-2026-33343).

Source ↗

Browse by month