Releases

Check if affected (2)

• securityConstant-time password comparison in the static grpc auth plugin

  Applies if you use the static grpc auth plugin.

• securityEscaping of reflected form values in the twopcz handler

  Applies if you use the twopcz handler.

Action needed (16)

• securityhighThe com_github_wasmtime dependency update

  The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.

• securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220

  The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.

• securityhighzstd RLE zip bomb, CVE-2026-48044

  The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

• securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042

  The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

• securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743

  The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.

• securitymediumAuthz per route crash, CVE-2026-47205

  The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.

• securitymediumThe ext_proc response issue, CVE-2026-47207

  The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.

• securitymediumRouter internal redirects crash, CVE-2026-47221

  The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.

• securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775

  The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.

• securitymediumThe grpc_stats filter segfault, CVE-2026-47204

  The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.

• securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692

  The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.

• securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778

  The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.

• securitymediumOAuth2 filter late token completion, CVE-2026-48090

  The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.

• securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497

  The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.

• securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706

  The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.

• securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch

  The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.

Action needed (1)

• securityhighcom_github_wasmtime dependency update, CVE-2026-47261

  The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Action needed (1)

• securityhighHighly nested JSON destructor stack overflow

  The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Action needed (1)

• securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042

  This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (9)

• breakingThe confightp.framedSnappy feature gate, removed

  Applies if you use confightp.framedSnappy.

• breakingThe configoptional.AddEnabledField feature gate, removed

  Applies if you use configoptional.AddEnabledField.

• breakingThe confmap.newExpandedValueSanitizer feature gate, removed

  Applies if you use confmap.newExpandedValueSanitizer.

• + 6 more on the release page

Check if affected (2)

• breakingKruise APIs upgraded to v1beta1

  Applies if your manifests use the listed Kruise APIs at v1alpha1.

• breakingNumerical string values for maxUnavailable and maxSurge rejected

  Applies if you configure numerical string values for maxUnavailable or maxSurge.

Check if affected (5)

• securitycriticalcontainerd v2.3.2 security fixes

  Applies if you use containerd.

• securityhighCVE-2026-53657 and GHSA-2j9v-p4xj-cjw2 guest agent socket fix

  Applies if you run a QEMU VM that uses the guest agent socket.

• breakingcontainerd.user default on non-Linux guests

  Applies if you run non-Linux guests.

• + 2 more on the release page

Action needed (2)

• securitycriticalgolang.org/x/net and OpenTelemetry dependency updates

  The golang.org/x/net dependency is updated to v0.55.0, and OpenTelemetry to v1.43.0. These updates address reported advisories GO-2026-5026, GO-2026-4918, and GO-2026-4985.

• securityPatched UI dependency versions

  The UI dependencies react-router-dom, vitest, vite, and postcss are updated to patched versions to resolve security advisories.

Action needed (2)

• securityhighFix for CVE-2026-55225

  The release fixes CVE-2026-55225, also identified as GHSA-mw9r-p8xp-wx96.

• securitymediumFix for CVE-2026-55226

  The release fixes CVE-2026-55226, also identified as GHSA-r427-j2h7-wv3m.

Action needed (1)

• securityThe postgres crates, updated for Rust security advisories

  The postgres crates are updated for RUSTSEC-2026-0178, RUSTSEC-2026-1079, and RUSTSEC-2026-0180. This dependency update ships in wasmCloud v2.4.0.

Check if affected (3)

• securitymediumMySQL schema migrations 008

  Applies if you use the MySQL backend.

• securityConstant-time preshared key authentication

  Applies if you use preshared key authentication.

• securityRequired OIDC issuer and audience configuration

  Applies if authn.method is set to oidc.

Check if affected (2)

• breakingStale MDS and RGW pdbs removed

  Applies if you configure MDS and RGW pdbs.

• breakingcsi-addons disabled by default

  Applies if you enable csi-addons.

Check if affected (2)

• breakingDefault Ceph version 19.2.4

  Applies if you use Ceph.

• breakingStale MDS and RGW PDB cleanup

  Applicability is not stated in the release notes.

Action needed (2)

• securityThe infinispan dependency upgrade

  infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.

• breakingThe unused json-schema runtime dependency, removed

  The unused json-schema runtime dependency has been removed.

Check if affected (3)

• securityWildcard namespace bypass for selectorless ipBlock rules, fixed

  Applies if you configure ipBlock.

• breakingThe loadBalancer.standalone Helm option, removed

  Applies if you configure loadBalancer.standalone.

• breakingThe l2podAnnouncements.interface Helm value, replaced by l2podAnnouncements.interfacePattern

  Applies if you configure l2podAnnouncements.interface and enable L2 pod announcements.

Check if affected (1)

• breakingNamespace-restricted ExternalWorkloads endpoints

  Applies if you use ExternalWorkloads.

Check if affected (1)

• breakingDefault resource requirements for internal containers are removed

  Applies if you do not set default-container-resource-requirements.

Check if affected (1)

• breakingTekton Resolver object restrictions

  Applies if you use Tekton Resolvers.

Action needed (1)

• securitycriticalgoogle.golang.org/grpc updated to 1.79.3 for CVE-2026-33186

  The google.golang.org/grpc dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.

Action needed (1)

• securitycriticalThe google.golang.org/grpc dependency fix for CVE-2026-33186

  The google.golang.org/grpc dependency includes a fix for CVE-2026-33186 in v1.6.3.

Action needed (1)

• breakingPod label removal

  The pod label is removed in this release.

Action needed (2)

• breakingmodel-registry UI enabled by default

  The model-registry UI is enabled by default in this release.

• breakingTwo dex replicas without a sticky service

  dex runs two replicas without a sticky service by default in this release.

Action needed (1)

• securityhighazure-core pinned for CVE-2026-21226

  The azure-core dependency is pinned to >=1.38.0 to address CVE-2026-21226.

Action needed (8)

• securitymediumThe golang.org/x/image dependency update for GO-2026-4962

  golang.org/x/image is updated to v0.39.0 for GO-2026-4962.

• securityThe durabletask-go and pgx dependency updates

  durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.

• breakingThe WorkflowsRemoteActivityReminder default, enabled

  WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.

• breakingThe HotReload default, enabled

  HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.

• breakingSidecar probe defaults

  Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.

• breakingThe HotReload default, enabled in v1.18

  HotReload is enabled by default in v1.18.

• breakingLiveness and readiness probe defaults

  The default liveness probe is widened, and the readiness probe default is tightened.

• breakingChanged sidecar probe defaults

  Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.

Check if affected (3)

• breakingInsecure TLS cipher suite default

  Applies if you enable allow_insecure_cipher_suites.

• breakingJetStream strict mode default

  Applies if you use JetStream.

• breakingDowngrade compatibility for new v2.12 features

  Applies if you use new v2.12 features.

Check if affected (1)

• breakingBound DoH3 HTTP/3 request header size

  Applies if you use DoH3.

Check if affected (1)

• breakingThe error_flatten experiment, enabled in OSS

  Applicability is not stated in the release notes.

Check if affected (3)

• securityStored XSS protection in Alertmanager and Store Gateway status pages

  Applies if you run Alertmanager or Store Gateway.

• securityWrappedHistogram native histogram size limit

  Applies if you use native histograms.

• breakingDecompressed gzip output limit for ParseProtoReader and OTLP ingestion

  Applies if you use the OTLP ingestion path.

Action needed (1)

• securityhighCVE-2026-47774 Envoy denial-of-service fix

  The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Action needed (1)

• securityhighnghttp2 patch for CVE-2026-27135

  The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Action needed (2)

• securityhighCVE-2026-4800 lodash code injection

  CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.

• securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization

  CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.

Action needed (1)

• securityhighnghttp2 CVE-2026-27135 patch

  The nghttp2 CVE-2026-27135 patch is applied in the release.

Action needed (1)

• securityhighThe nghttp2 CVE-2026-27135 patch

  Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Action needed (1)

• securityhighThe nghttp2 CVE-2026-27135 patch

  Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

• breakingCeph CSI operator for driver settings

  Applies if you configure CSI driver settings.

• breakingROOK_DELETE_UNUSED_CRUSH_RULES default

  Applies if the Ceph mgr is running.

Check if affected (5)

• breakingV2 Backing Images removal

  Applies if you use V2 Backing Images.

• breakingThe data-engine-cpu-mask default, changed

  Applies if you do not configure data-engine-cpu-mask.

• breakingLive migration constraint for older CLI API versions

  Applies if you use an engine image with a CLI API version older than 12.

• + 2 more on the release page

Check if affected (7)

• securityCredential headers on cross-host redirects and HTTPS downgrades

  Applicability is not stated in the release notes.

• breakingScaledObject name length validation

  Applies when a ScaledObject name exceeds 63 characters.

• breakingPositive unprocessedEventThreshold values

  Applies if you configure a non-positive unprocessedEventThreshold.

• + 4 more on the release page

Check if affected (1)

• breakingQEMU 2MB OVMF images dropped by openSUSE

  Applicability is not stated in the release notes.

Action needed (4)

• securitymediumPrometheus dependency update for GHSA-vffh-x6r8-xx99

  Updates github.com/prometheus/prometheus to address stored XSS advisory GHSA-vffh-x6r8-xx99.

• securitymediumAdmission webhook request body limits

  The admission webhook now limits request bodies, fixing the denial-of-service risk identified by CVE-2026-44247 and GHSA-8wxp-xxp2-rcgx.

• breakingDRA scheduling integration default

  DRA scheduling integration is enabled by default.

• breakingDRA scheduling integration default behavior

  DRA scheduling integration is enabled by default to align with Kubernetes 1.34 and later behavior. Set predicate.DynamicResourceAllocationEnable to false to disable it.