Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: KyvernoClear ×

Kyvernov1.18.2SecurityJul 10, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

securitySecurity dependency updates
Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

securityNamespace-boundary enforcement in generator.apply()
Applies if you use generator.apply().
generator.apply() now enforces the namespace boundary for gpol and mpol generators. The GHSA-79gf-7frw-68m9 fix is backported to release-1.18.

Source ↗

Kyvernov1.16.4SecurityApr 23, 2026

ACTION 12CHECK 3OTHER 2View full analysis

A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.

Action needed (12)

securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github.com/docker/cli dependency update
The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.5.1
The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.3.1
The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.4.1
The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.

Check if affected (3)

securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
HTTP is disabled by default in namespaced policies to address CVE-2026-4789.
securityCVE fixes for go < 1.25.8
Applies if you depend on go < 1.25.8.
This release resolves CVEs affecting go < 1.25.8.
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.
Access to configmap is restricted for namespaced policies.

Source ↗

Kyvernov1.17.2SecurityApr 23, 2026

ACTION 6CHECK 2OTHER 17View full analysis

A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.

Action needed (6)

securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.

Check if affected (2)

securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
HTTP is disabled by default in namespaced policies as a backport associated with CVE-2026-4789.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.
Access to configmap is restricted for namespaced policies.

Source ↗

Kyvernov1.15.3SecurityJan 27, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with security-related fixes for the Go toolchain and cross-namespace access through apiCall. It also contains ordinary defect fixes and capability or behavior changes.

Action needed (1)

securityThe go version update for standard library CVEs
The go version is updated to fix standard library CVEs in this release.

Check if affected (1)

securityCross-namespace access through apiCall prevented
Applies if you use apiCall.
Cross-namespace access in apiCall is prevented by this fix, which ships in this release.

Source ↗

Browse by month