Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×

CoreDNSv1.14.3Kubernetes CoreApr 22, 2026

ACTION 1CHECK 1OTHER 34View full analysis

A maintenance release that adds operator-facing options and transport, plugin, and protocol support while correcting defects. It is built with Go 1.26.2, which contains fixes for disclosed CVEs; other changes concern operators using the affected features or behaviors.

Action needed (1)

securitycriticalGo 1.26.2 build with security fixes
The release is built with Go 1.26.2, which includes security fixes for CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Check if affected (1)

breakingOversized DoH GET query parameter rejection
Applies if you use DoH.

Source ↗

containerdv2.2.3Kubernetes CoreApr 14, 2026

ACTION 1OTHER 14View full analysis

containerd v2.2.3 includes a disclosed security-related update to spdystream, alongside correctness, runtime, extraction, and dependency/toolchain changes. The recorded advisory is CVE-2026-35469.

Action needed (1)

securityhighspdystream dependency update for CVE-2026-35469
The spdystream dependency is updated in containerd v2.2.3 in connection with CVE-2026-35469.

Source ↗

containerdv2.0.8Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).

Source ↗

containerdv2.1.7Kubernetes CoreApr 14, 2026

ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub.com/moby/spdystream v0.5.1 update
The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if pod events are used.

Source ↗

containerdv1.7.31Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securitySanitized gRPC errors in pod events
Applies if you use pod events.

Source ↗

Helmv3.20.2Kubernetes CoreApr 9, 2026

CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.

Source ↗

Helmv4.1.4Kubernetes CoreApr 9, 2026

ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

securityhighPlugin verification when .prov is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.

Source ↗

Limav2.1.1Kubernetes CoreApr 3, 2026

CHECK 1OTHER 4View full analysis

A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.

Check if affected (1)

securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.

Source ↗

Browse by month