RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Mar 2026Clear ×
Emissary-Ingressv4.0.1Networking & MessagingMar 26, 2026
ACTION 1CHECK 6OTHER 14View full analysis

A release with operator-facing compatibility changes, including feature removals, aligned chart and application versions, GHCR-only chart distribution, and a changed CRD conversion-webhook default. It also updates dependencies and the Python interpreter to resolve CVEs, with additional defect fixes and new service and architecture capabilities.

Action needed (1)

  • securityDependency and Python interpreter updates for CVE fixes

    Many dependencies and the Python interpreter were updated to resolve CVEs.

Check if affected (6)

  • breakingCustom error responses and header-case mangling, removed

    Applies if you use Ambassador Edge Stack's custom error responses or header-case mangling features.

  • breakingHelm chart and Emissary version alignment

    Applies if you use the Helm chart.

  • breakingGHCR-only Helm chart distribution

    Applies if you use Emissary's Helm charts.

  • + 3 more on the release page
Source ↗
NATSv2.12.6Networking & MessagingMar 24, 2026
ACTION 1CHECK 13OTHER 36View full analysis

A maintenance release with multiple security fixes, tighter JWT and MQTT-related enforcement, and dependency manifest updates. It also includes correctness fixes and improvements across networking, monitoring, clustering, and JetStream.

Action needed (1)

  • breakingJWT size limit

    JWTs now have a 1MB size limit.

Check if affected (13)

  • securityhighMQTT security fixes

    Applies if you use MQTT.

  • securityhighLeafnode security fix

    Applies if you use leafnodes.

  • securityhighCommand-line credential security fix

    Applies if you provide credentials on the command line.

  • + 10 more on the release page
Source ↗
NATSv2.11.15Networking & MessagingMar 24, 2026
ACTION 1CHECK 11OTHER 22View full analysis

A maintenance release with multiple disclosed security fixes, correctness fixes, stricter validation and permission constraints, and dependency and toolchain updates. It also includes fixes across MQTT, JetStream, leafnodes, WebSockets, monitoring, and clustering.

Action needed (1)

  • breakingThe JWT size limit

    JWTs now have a 1MB size limit.

Check if affected (11)

Source ↗
Contourv1.33.3Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc v1.79.3 update

    google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.

  • securityEnvoy v1.35.9 update

    The Envoy dependency is updated to v1.35.9 to address security vulnerabilities.

Check if affected (1)

  • breakingRemoval of hostPort: 8002 from example manifests

    Applies if you use hostPort in example manifests.

Source ↗
Contourv1.32.4Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3

    google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

  • breakinghostPort: 8002 removed from example manifests

    Applies if hostPort: 8002 is configured in example manifests.

Source ↗
Contourv1.31.5Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186

    The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    The release bumps Envoy to v1.34.13.

Check if affected (1)

  • breakingEnvoy metrics hostPort: 8002 removed from example manifests

    Applies if example manifests use hostPort: 8002.

Source ↗
Ciliumv1.19.2Networking & MessagingMar 23, 2026
CHECK 2OTHER 46View full analysis

A maintenance release with operator-relevant bug fixes, new configuration and diagnostic capabilities, and dependency and image updates. Two fixes address security-relevant exposure or policy bypass, and no deprecations or removals are announced.

Check if affected (2)

  • securityWorld-accessible Envoy admin socket

    Applies if envoy runs.

  • securityIngress policy enforcement for local backends

    Applies if you use ingress policies and local backends.

Source ↗
Ciliumv1.17.14Networking & MessagingMar 23, 2026
CHECK 1OTHER 21View full analysis

A maintenance release with bug fixes, dependency and image updates, improved bugtool output, and a GKE channel fix. The Envoy admin socket fix addresses its world-accessible creation.

Check if affected (1)

  • securityThe Envoy admin socket's accessibility

    Applies if Envoy runs.

Source ↗
Strimzi0.45.2Networking & MessagingMar 12, 2026
ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

  • securityhighGRPC Netty Shaded update for CVE-2025-55163

    GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.

  • securitymediumZookeeper update for CVE-2024-47554

    The Zookeeper dependency was upgraded to remediate CVE-2024-47554.

  • securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864

    Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.

  • securitymediumNetty 4.1.130.Final update for CVE-2025-67735

    Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.

  • securitymediumApache Log4J 2.25.3 update for CVE-2025-68161

    Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.

  • securitymediumVertx 4.5.24 update for CVE-2026-1002

    Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.

  • securitymediumJackson update for GHSA-72hv-8253-57qq

    Jackson was updated to address GHSA-72hv-8253-57qq.

  • securityVert.x and Netty dependency updates

    The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

  • breakingKubernetes support narrowed to 1.25 and newer

    Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

  • breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46

    Applies if you use the Strimzi MirrorMaker 2 Extensions.

  • breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46

    Applies if you use the Strimzi EnvVar Configuration Provider.

  • deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46

    Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Source ↗
Envoyv1.37.1Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()

    The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix

    The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset

    HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

Source ↗
Envoyv1.36.5Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 json null terminator write fix

    Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 HTTP decoder reset handling

    Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

  • securityhighCVE-2026-26308 rbac multivalue header bypass fix

    Applies if you use rbac.

  • securitymediumCVE-2026-26330 ratelimit response phase limit crash fix

    Applies if you use ratelimit.

Source ↗
Envoyv1.35.9Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

Envoy v1.35.9 is a maintenance release with security fixes in RBAC, network address handling, JSON processing, and HTTP downstream reset handling. It also includes an ordinary defect correction and an updated Docker base-image dependency.

Action needed (4)

  • securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5, multivalue header bypass in RBAC

    Envoy v1.35.9 fixes CVE-2026-26308 and GHSA-ghc4-35x6-crw5, addressing a multivalue header bypass in RBAC.

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p, scoped IPv6 address crash

    Envoy v1.35.9 fixes CVE-2026-26310 and GHSA-3cw6-2j68-868p, preventing a crash in getAddressWithPort() when it receives a scoped IPv6 address.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943, JSON null-terminator write

    Envoy v1.35.9 fixes CVE-2026-26309 and GHSA-56cj-wgg3-x943, correcting an off-by-one write that could corrupt the string null terminator in JSON handling.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px, HTTP decode methods after downstream reset

    Envoy v1.35.9 fixes CVE-2026-26311 and GHSA-84xm-r438-86px, ensuring that decode* methods are blocked after a downstream reset in HTTP handling.

Source ↗
Envoyv1.34.13Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

A release with disclosed security fixes in RBAC, network handling, JSON processing, and HTTP decoding, plus an OAuth2 correctness fix and updated Docker base images. Upgrading addresses the security vulnerabilities, while the other fixes require no operator action.

Action needed (4)

  • securityhighCVE-2026-26308 multivalue header bypass in rbac

    CVE-2026-26308 (GHSA-ghc4-35x6-crw5) fixes a multivalue header bypass in rbac. The fix ships in this Envoy release.

  • securitymediumCVE-2026-26310 crash in getAddressWithPort()

    CVE-2026-26310 (GHSA-3cw6-2j68-868p) fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The fix ships in the Envoy network code.

  • securitymediumCVE-2026-26309 off-by-one write in json processing

    CVE-2026-26309 (GHSA-56cj-wgg3-x943) fixes an off-by-one write that could corrupt the string null terminator. The fix ships in the Envoy json code.

  • securitymediumCVE-2026-26311 blocking of decode* methods after downstream reset

    CVE-2026-26311 (GHSA-84xm-r438-86px) ensures that decode* methods are blocked after a downstream reset. The fix ships in the Envoy http code.

Source ↗
Istio1.29.1Networking & MessagingMar 10, 2026
ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

Source ↗
Istio1.28.5Networking & MessagingMar 10, 2026
ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

  • securityhighCVE-2026-26308 multivalue header bypass fix in RBAC

    CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.

  • securitymediumCVE-2026-26311 HTTP decode method fix

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write in Istio.

  • securitymediumCVE-2026-26330 ratelimit response phase crash fix

    CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.

  • securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix

    CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

  • securityAuthentication for XDS debug endpoints on port 15010

    Applies if you expose XDS debug endpoints.

  • securityBearer token realm URL validation for WasmPlugin image fetching

    Applies if you use WasmPlugin image fetching.

  • securityNamespace-based authorization for HTTP debug endpoints on port 15014

    Applies if you expose HTTP debug endpoints.

Source ↗
Istio1.27.8Networking & MessagingMar 10, 2026
ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

  • securitymediumCVE-2026-26311 HTTP decode method correction

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

Source ↗
NATSv2.12.5Networking & MessagingMar 9, 2026
CHECK 3OTHER 65View full analysis

A maintenance release with fixes for two CVEs, many correctness issues, expanded JetStream configuration capabilities, and dependency updates. Operators of clustered deployments should review the documented regression affecting stream updates and the changed max_conns behavior.

Check if affected (3)

  • securityCVE-2026-29785 fix for leafnode compression

    Applies if leafnode compression is enabled.

  • securityCVE-2026-27889 fix for WebSockets

    Applies if WebSockets are enabled.

  • breakingThe max_conns server configuration value

    Applies if you configure max_conns in the server configuration.

Source ↗
NATSv2.11.14Networking & MessagingMar 9, 2026
CHECK 2OTHER 7View full analysis

A maintenance release with two security fixes, a Go toolchain version change, and several WebSockets correctness fixes. The WebSockets changes cover compressed frame negotiation, protocol validation, connection upgrades, frame validation, compressor state, and empty compressed buffers.

Check if affected (2)

  • securityhighCVE-2026-29785 fix for leafnode compression

    Applies if CVE-2026-29785 is present and leafnode compression is enabled.

  • securityhighCVE-2026-27889 fix for WebSockets

    Applies if CVE-2026-27889 is present and WebSockets is enabled.

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023