AI-analyzed release notes for CNCF graduated and incubating projects.
containerd v2.2.3 includes a disclosed security-related update to spdystream, alongside correctness, runtime, extraction, and dependency/toolchain changes. The recorded advisory is CVE-2026-35469.
Action needed (1)
securityhighspdystream dependency update for CVE-2026-35469
The spdystream dependency is updated in containerd v2.2.3 in connection with CVE-2026-35469.
containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.
Action needed (1)
securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.
Action needed (2)
securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub. v0.5.1 update
The release updates github. to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securityCredential sanitization before gRPC returns
Applies if pod events are used.
containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.
Action needed (1)
securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.
Check if affected (1)
securitySanitized gRPC errors in pod events
Applies if you use pod events.
A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.
Check if affected (1)
securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
A release with Windows artifacts, broader guest and template configuration support, and changed vz audio handling. It also updates the bundled nerdctl distribution and dependencies, including security updates in BuildKit and CNI plugins that are obtained by upgrading.
Check if affected (1)
securityBuildKit and CNI plugins security updates
Applies if you use BuildKit or CNI plugins.
CRI-O v1.33.11 contains no operator-facing changes in the supplied release material. No specific flags, fields, resources, metrics, or advisories are identified for this version.
Source ↗CRI-O v1.35.2 is an operator-facing maintenance release focused on configuration and runtime behavior. It concerns deployments using artifact stores, pinned images, image pulls, or the affected metrics paths.
Source ↗CRI-O v1.34.7 contains no operator-facing change details in the release note. There are no specific changes to assess for this release.
Source ↗A maintenance release with changes to authorization behavior and an etcdctl endpoint command regression. The recorded release notes also include headings and documentation updates.
A maintenance release with changes to etcdserver access and an etcdctl command regression. The recorded changes do not include item details for this release.
Source ↗A maintenance release with permission and etcdctl regression fixes. The recorded changes do not include details for individual release-note entries.
A feature and maintenance release that introduces a vendor-neutral API with a user-controlled migration workflow, alongside preview Dynamic Zones support. It also changes Helm and runtime image distribution locations and updates dependencies.
Check if affected (2)
breakingThe helm repository, switched to OCI
Applies if you use Helm.
breakingThe API group, renamed to k8gb.
Applies if you use k8gb..
A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.
Action needed (4)
securitycriticalgoogle. updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo. updated to v1.
The release updates go. to v1.. The update addresses GO-2026-4394.
securityhighgolang. updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (1)
securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.
Action needed (3)
securitycriticalThe google. dependency, updated to 1.
The release updates google. to 1. to resolve CVE-2026-33186.
securityhighThe go. dependency, updated to v1.
The release updates go. to v1. to resolve GO-2026-4394.
securityhighThe golang. dependency, updated to v0.
The release updates golang. to v0. to resolve GO-2026-4559.
Check if affected (2)
securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang. and google. to address reported issues.
Action needed (4)
securitycriticalgoogle. updated to 1.
The google. dependency is updated to 1. to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang. updated to v0.
The golang. dependency is updated to v0. to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.
A maintenance release with Kubeadm correctness fixes and an adjustment to DRA device taint eviction status behavior. It contains no identified security changes or operator actions.
Source ↗A kubeadm maintenance patch corrects defects in cluster lifecycle handling. The changes affect etcd client endpoints and reset-time unmounting of /var/lib/kubelet peer mounts.
A maintenance release focused on operator-facing bug fixes in admission validation and cluster lifecycle workflows. No security advisories, operator-actionable removals, default changes, or new constraints are described.
Source ↗A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}. to /home/${USER}. with a compatibility symlink, and no security changes are disclosed.
Check if affected (1)
breakingQEMU as the default hypervisor for non-native architectures
Applies if QEMU runs on non-native architectures.
Helm v3.20.1 fixes preservation of user-provided nil values in charts with empty maps or no default values, and corrects OCI references that combine a tag and digest. It also updates the Kubernetes dependency group.
Source ↗Helm v4. is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.
Action needed (1)
securityhighThe go. dependency update for GO-2026-4394
The go. dependency was updated to v1. for GO-2026-4394 in Helm v4..
A maintenance release with defect corrections, behavior changes, and a fix for credential leakage in pod events. It also updates the Go toolchain and adds a warning for concurrent container creation.
Action needed (1)
securityCredential leakage prevention in pod events
Credential leakage is prevented in pod events in this containerd release.
A maintenance release with proxy protocol support, operator-visible behavior changes, and several correctness fixes. It also updates the Go build dependency with cited security fixes and changes ACL-related and query-name handling.
Action needed (1)
securityhighThe Go 1. build dependency and cited security fixes
The build uses Go 1., which includes security fixes for CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.
Check if affected (2)
securityhighThe rewrite and acl ordering, CVE-2026-26017
Applies if you use both rewrite and acl.
securityhighplugin/loop query name generation, CVE-2026-26018
Applies if plugin/loop runs.
This release includes an operator-facing correctness fix in CRI-O, covering IRQ SMP affinity handling during late container deletion. No standalone change details are provided for display here.
Source ↗CRI-O v1.35.1 adds TLS configuration options and corrects pull and container-runtime defects. The release also includes dependency manifest updates, which are not separately described operator-facing changes.
Source ↗CRI-O v1.34.6 contains no recorded operator-facing changes. No release details are available to assess from the supplied notes.
Source ↗A maintenance release updates the Kubernetes build to Go 1.25.7. No other release changes are recorded here.
Source ↗A maintenance release updates the Kubernetes build toolchain to Go 1.24.13. No other operator-facing changes are recorded.
Source ↗A maintenance release updates the Go toolchain used to build Kubernetes. No other substantive changes are recorded.
Source ↗A maintenance release with an updated Go toolchain used to build Kubernetes. The recorded release notes contain no specific operator-facing changes beyond that build update.
Source ↗v0.18.1 is a dependency update release. It includes an update to coredns-plugin for the latest security fixes, alongside other dependency version changes.
Action needed (1)
securityThe coredns-plugin dependency, updated for security fixes
The coredns-plugin dependency is updated to include the latest security fixes in v0.18.1.
A maintenance release postpones removal of one flag and reverses another flag's deprecation. It also includes dependency and toolchain updates addressing named security advisories.
Action needed (2)
securityhighThe go toolchain, updated to 1.24.13
Binaries are compiled using go 1.. The toolchain update addresses CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
securitymediumThe golang. dependency, updated to 0.45.0
golang. is updated to 0.45.0 to address CVE-2025-47914 and CVE-2025-58181.
Plan ahead (1)
deprecatedThe --max-snapshots flag, removal postponedremoval planned in v3.8
Applies if you use --max-snapshots.
A maintenance release that changes the Go toolchain used to compile binaries. It also includes fixes for three named CVEs and their corresponding GHSA advisories.
Action needed (1)
securityhighGo 1.24.13 toolchain for compiled binaries
Binaries are compiled with Go 1.24.13. This release includes fixes for CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, with corresponding advisories GHSA-gm9r-q53w-2gh4, GHSA-xvqr-69v8-f3gv4, and GHSA-8jvr-vh7g-f8gx.
A maintenance release updates the Go dependency and toolchain to go 1.. It addresses three CVEs and their corresponding GitHub advisories.
Action needed (1)
securityhighGo 1.24.13 dependency and toolchain update
The Go dependency and toolchain update to go 1. addresses CVE-2025-61726, CVE-2025-61731, and CVE-2025-61732, along with GHSA-8jvr-vh7g-f8gx, GHSA-gm9r-q53w-2gh4, and GHSA-xvqr-69v8-f3gv.
A maintenance release with correctness fixes in device allocation and kubeadm behavior, plus a Go toolchain update. The changes address scheduling races, etcd learner promotion, argument ordering, and Node patch retries.
Source ↗A maintenance release corrects operator-relevant behavior across scheduling, kubeadm, logging, and Windows networking. Kubernetes is now built using Go 1.24.12, and no security advisories or security-specific fixes are disclosed.
Source ↗A maintenance release focused on correctness fixes and regression repairs across Kubernetes components. It also updates the Go toolchain and changes kubeadm retry behavior.
Source ↗A maintenance release with numerous correctness fixes and an enforced feature-gate default change. It also updates the Go toolchain and hnslib dependency, with no disclosed security advisories.
Check if affected (1)
breakingThe SchedulerAsyncAPICalls feature gate, disabled by default
Applies if you use the SchedulerAsyncAPICalls feature gate.
