AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.
Check if affected (1)
securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.
A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.
Action needed (4)
securitycriticalgoogle. updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo. updated to v1.
The release updates go. to v1.. The update addresses GO-2026-4394.
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (1)
securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.
Action needed (3)
securitycriticalThe google. dependency, updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighThe go. dependency, updated to v1.
The release updates go. to v1. to resolve GO-2026-4394.
securityhighThe golang. dependency, updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (2)
securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang. and google. to address reported issues.
Action needed (4)
securitycriticalgoogle. updated to 1.
The google. dependency is updated to 1. to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang. updated to v0.
The golang. dependency is updated to v0. to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.
Helm v4. is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.
Action needed (1)
securityhighThe go. dependency update for GO-2026-4394
The go. dependency was updated to v1. for GO-2026-4394 in Helm v4..
A maintenance release with defect corrections, behavior changes, and a fix for credential leakage in pod events. It also updates the Go toolchain and adds a warning for concurrent container creation.
Action needed (1)
securityCredential leakage prevention in pod events
Credential leakage is prevented in pod events in this containerd release.
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
v0.18.1 is a dependency update release. It includes an update to coredns-plugin for the latest security fixes, alongside other dependency version changes.
Action needed (1)
securityThe coredns-plugin dependency, updated for security fixes
The coredns-plugin dependency is updated to include the latest security fixes in v0.18.1.
A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.
Action needed (2)
securityhighThe go toolchain, updated to 1.24.13
Binaries are compiled using go 1.. The toolchain update addresses CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
securitymediumThe golang. dependency, updated to 0.45.0
golang. is updated to 0.45.0 to address CVE-2025-47914 and CVE-2025-58181.
Plan ahead (1)
deprecatedThe --max-snapshots flag, removal postponedremoval planned in v3.8
Applies if you use --max-snapshots.
A maintenance release that changes the Go toolchain used to compile binaries. It also includes fixes for three named CVEs and their corresponding GHSA advisories.
Action needed (1)
securityhighGo 1.24.13 toolchain for compiled binaries
Binaries are compiled with Go 1.24.13. This release includes fixes for CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, with corresponding advisories GHSA-gm9r-q53w-2gh4, GHSA-xvqr-69v8-f3gv4, and GHSA-8jvr-vh7g-f8gx.
A maintenance release updates the Go dependency and toolchain to go 1.. It addresses three CVEs and their corresponding GitHub advisories.
Action needed (1)
securityhighGo 1.24.13 dependency and toolchain update
The Go dependency and toolchain update to go 1. addresses CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, along with GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
A security-focused maintenance release addresses disclosed Go vulnerabilities and improves proxy connection-pool performance. It also adds the forward plugin's max_idle_conns parameter, which defaults to 0 for an unbounded pool.
Action needed (1)
securityhighCVE-2025-68119 fix
The release also addresses CVE-2025-68119, which affects the stated Go versions.
Check if affected (1)
securitycriticalGo security vulnerability fixes
Applicability is not stated in the release notes.
