AI-analyzed release notes for CNCF graduated and incubating projects.
This release narrows Linkerd Viz scraping behavior and adds the inbound_http_request_duration_seconds and inbound_grpc_request_duration_seconds metrics histograms. It also updates dependencies and ships proxy v2.342.0.
Check if affected (1)
breakingLinkerd Viz default scraping configuration
Applies if you use Linkerd Viz.
This release expands Windows and device-management support while changing edge database and node-query behavior. It also updates Kubernetes and changes how consumers retrieve device status through the DeviceStatus CRD.
Check if affected (1)
breakingDevice status moved to the DeviceStatus CRD
Applies if you use the Device CRD.
A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.
Action needed (3)
securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.
Check if affected (2)
securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.
A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.
Action needed (3)
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.
Check if affected (2)
securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.
A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.
Action needed (1)
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes an off-by-one write in JSON handling.
Check if affected (10)
securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-26311 HTTP decode method restriction
Applies if you use HTTP.
A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.
Action needed (7)
securityhighCVE-2026-26308 multivalue header bypass fix in RBAC
CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method fix
CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write in Istio.
securitymediumCVE-2026-26330 ratelimit response phase crash fix
CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.
Check if affected (3)
securityAuthentication for XDS debug endpoints on port 15010
Applies if you expose XDS debug endpoints.
securityBearer token realm URL validation for WasmPlugin image fetching
Applies if you use WasmPlugin image fetching.
securityNamespace-based authorization for HTTP debug endpoints on port 15014
Applies if you expose HTTP debug endpoints.
A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.
Action needed (3)
securitymediumCVE-2026-26311 HTTP decode method correction
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write.
Check if affected (6)
securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix
Applies if you use JWKS Resolver.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix
Applies if you use Debug Endpoints.
This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.
Action needed (2)
securityhighGo v1. update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1. to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.
Check if affected (4)
securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.
Check if affected (1)
breakingThe argocd. format, changed
Applies if argocd. and argocd. are configured.
A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.
Check if affected (3)
securityCVE-2026-29785 fix for leafnode compression
Applies if leafnode compression is enabled.
securityCVE-2026-27889 fix for WebSockets
Applies if WebSockets are enabled.
breakingThe max_conns server configuration value
Applies if you configure max_conns in the server configuration.
A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.
Check if affected (2)
securityhighCVE-2026-29785 fix for leafnode compression
Applies if CVE-2026-29785 is present and leafnode compression is enabled.
securityhighCVE-2026-27889 fix for WebSockets
Applies if CVE-2026-27889 is present and WebSockets is enabled.
A feature and maintenance release that expands configuration and scheduler capabilities while changing configuration controls and the priorities type. Dependency versions are updated, and no security advisories or explicitly described vulnerabilities are mentioned.
Action needed (1)
breakingThe priorities type, changed to int32
The priorities type changed from string to int32 in v2.4.2.
Check if affected (1)
breakingThe Enable flag, removed from seedPeer
Applies if you configure Enable.
A release with breaking configuration and API changes, a Go 1.25.7 requirement, new capabilities, and bug and performance fixes. No security advisories or security-specific fixes are identified.
Action needed (1)
breakingGo 1.25.7 requirement
The codebase now requires Go 1.25.7, with Go version consistency enforced across the codebase.
Check if affected (2)
breakingLegacy response format of the remote sampling endpoint, removed
Applies if you use the remote sampling endpoint.
breakingtraces. renamed to traces.
Applies if you configure traces..
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.
Action needed (2)
securityhighCVE-2026-27133 and CVE-2026-27134 security fixes
Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.
breakingThe ServerSideApplyPhase1 feature gate default
The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.
Check if affected (2)
breakingKubernetes version support
Applies if you use Kubernetes 1.27, 1.28, or 1.29.
breakingKafka 4.0.0 and 4.0.1 support
Applies if you use Kafka 4.0.0 or 4.0.1.
Plan ahead (1)
deprecatedThe ingress listener type deprecation
Applies if you configure the ingress listener type.
This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.
Check if affected (4)
securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.
Check if affected (1)
securitySecurity fixes for three Backstage packages
Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.
Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue fixed
Applies if you use http_challenge.
securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed
Applies if you use x509pop.
A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue corrected
Applies if you use the http_challenge server node attestor plugin.
securityThe x509pop server node attestor plugin, CPU consumption issue corrected
Applies if you use the x509pop server node attestor plugin.
A feature and maintenance release adds workload affinity and anti-affinity scheduling, operator and API capabilities, and Helm encryption at rest. It also includes controller and scheduler fixes, dependency and image updates, and deprecations and removals.
Check if affected (4)
breakingnamespace validation for spec.
Applies if you use PropagationPolicy or OverridePolicy.
breakingStricter GroupByLabelKey validation in WorkloadAffinity
Applies if you configure GroupByLabelKey in WorkloadAffinity.
breakingUpdated default Kubernetes and ETCD images
Applicability is not stated in the release notes.
Plan ahead (3)
deprecatedThe --cluster-lease-duration flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-duration.
deprecatedThe --cluster-lease-renew-interval-fraction flag, deprecatedremoval date not announced
Applies if you use --cluster-lease-renew-interval-fraction.
deprecatedEtcd. in Karmada Init Configuration, deprecatedremoval date not announced
Applies if you configure Etcd. in Karmada Init Configuration.
A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.
Action needed (9)
securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang. dependency, updated
The golang. dependency is bumped.
securityThe github. dependency, updated
The github. dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github. dependency, updated
The github. dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.
Check if affected (3)
securityPlacement authorization for Dapr actor types
Applies if you use Placement.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
Plan ahead (2)
deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1., BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.
A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.
Check if affected (2)
securitycriticalBackup restore path traversal protection
Applies if you use backup storage.
securityhighManifest-based external decompression default, changed
Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.
A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.
Check if affected (2)
securityLoading compressor commands from MANIFEST, opt-in
Applies if you use --external-decompressor-use-manifest.
securityPath traversal through backup MANIFEST on restore blocked
Applies if backupengine runs.
This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.
Action needed (1)
securityhighThe go. dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go. dependencies include the fix for GHSA-9h8m-3fm2-qjrq.
Check if affected (1)
breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).
This release adds Prometheus capabilities and image/build options, changes defaults and outputs, improves performance, and fixes correctness defects. No security advisories or explicitly described vulnerabilities are present.
Check if affected (1)
breakingExpanded alert annotations hidden by default
Applies if you use the UI on the /alerts page.
OpenKruise v1.8.3 includes a constraint change for probe host configuration. Existing configurations that rely on previously accepted host values may require changes.
Check if affected (1)
breakingThe probe host field, restricted
Applies if your probe configurations use the host field.
This release restricts the host field in probe configuration. The section heading carries no operator-facing change.
Check if affected (1)
breakingRestricted probe host field
Applies if you configure host.
This release includes operator-facing behavior and API updates, along with default, image, and dependency changes. It also contains an internal build-tooling update and fixes for storage and gateway handling.
Check if affected (1)
breakingDefault gateway topology spread constraints for nvmeof
Applies if you use nvmeof.
Flux v2.8.0 expands capabilities across controllers, notifications, the CLI, and artifact handling while also including fixes and dependency updates. It removes the deprecated API versions v1beta2 and v2beta2 from CRDs and changes Kubernetes compatibility requirements, so users of those APIs or affected Kubernetes versions are the main audience.
Check if affected (1)
breakingThe Flux APIs v1beta2 and v2beta2, removed from CRDs
Applies if you use the Flux APIs v1beta2 or v2beta2 in CRDs.
This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.
Action needed (1)
securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0. to address CVE-2025-68121.
Check if affected (1)
breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.
A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.
Action needed (2)
securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.
Check if affected (4)
securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.
Action needed (1)
securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.
Check if affected (1)
breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.
A release with breaking changes to package installation and package-cache side-loading, alongside new operator capabilities and ordinary defect corrections. It also includes security-tagged dependency updates, but no advisory identifiers or vulnerability details are provided.
Action needed (7)
securitySecurity update for golang.
The golang. module was updated to v0. as a security update.
securitySecurity update for github.
The github. module was updated to v5. as a security update.
securitySecurity update for github.
The github. module was updated to v3. as a security update.
securitySecurity update for github.
The github. module was updated to v2. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v1. as a security update.
securitySecurity update for github.
The github. module was updated to v0. as a security update.
Check if affected (2)
breakingInput CRD installation from Function packages
Applies if you use Function packages and Input CRDs.
breakingPackage cache structure
Applicability is not stated in the release notes.
A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.
Check if affected (7)
breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.
Applies if you configure auth..
Plan ahead (2)
deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.
A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.
Action needed (1)
securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.
Check if affected (4)
securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config. with mutations or Config..
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.
Action needed (1)
breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.
Check if affected (4)
breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
This release combines performance improvements, bug fixes, and new configuration capabilities with a shuffle-sharding behavior change in Receive. It also upgrades Prometheus, deprecates a flag, and makes native histogram ingestion always enabled.
Check if affected (1)
breakingReceive shuffle sharding now uses consistent hashing
Applies if you use Receive.
A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.
Check if affected (1)
breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.
This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.
Action needed (1)
securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.
Check if affected (2)
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.
Jaeger v2.15.0 introduces a breaking constraint for trace and metric storage configuration. It also adds experimental MCP and ClickHouse capabilities, corrects API behavior, and includes an internal implementation change without direct operator impact.
Check if affected (1)
breakingTrace and metric storage configuration backend constraint
Applies if you configure trace or metric storage with more than one backend type.
