This release adds attestors, plugins, configuration options, and CLI/API capabilities. It also updates dependencies and includes behavior changes and defect fixes, with no security advisories or explicitly described vulnerabilities.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
A substantial operator-facing release with new CLI, Helm, and policy capabilities alongside fixes and dependency updates. It also changes existing behavior through security fixes, deprecations, removals, and stricter constraints that may require review before upgrading.
Action needed (7)
securityhighIntermediate certificate limits
Intermediate certificates are limited to mitigate CVE-2026-32280. The fix ships in Kyverno v1.19.0.
securityhighGo toolchain 1.26.3
The Go toolchain was upgraded to 1.26.3 to resolve CVE-2026-39836. The updated toolchain ships in Kyverno v1.19.0.
securityRegenerated CRDs and documentation for GHSA-79gf-7frw-68m9
CRDs and documentation were regenerated after the API bump associated with GHSA-79gf-7frw-68m9. The updated artifacts ship in Kyverno v1.19.0.
securityUpdated
golang.andorg/x/crypto x/netdependenciesThe
golang.dependency was updated to v0.53.0 andorg/x/crypto x/netto v0.56.0 to resolve security CVEs. The dependency updates ship in Kyverno v1.19.0.securityPatched ORAS and sigstore vulnerabilities
The ORAS and sigstore dependencies were patched for CodeQL vulnerabilities. The dependency fixes ship in Kyverno v1.19.0.
securityCodeQL vulnerability fixes
Open CodeQL security vulnerabilities were addressed. The fixes ship in Kyverno v1.19.0.
security
cel-gov0.30.0cel-gowas updated to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g. The updated dependency ships in Kyverno v1.19.0.
Check if affected (6)
breakingRequired
--resourcefor the migrate commandApplies when the migrate command runs.
breakingDefault
userInfogroups and UID during background scansApplies when background scans run.
breaking
excludeBootstrapResourceswebhook flagApplies when you configure Fail webhooks.
- + 3 more on the release page
Plan ahead (1)
deprecatedDeprecation notices for legacy
kyverno.policy typesio Applies when you use legacy
kyverno.policy types.io
A maintenance release with disclosed security fixes, a cleartext vault-keystore password correction, a Quarkus dependency upgrade, and other bug corrections. The fixes cover account and permission flows, secret handling, and runtime dependencies.
Action needed (2)
securitymediumCVE-2026-59888 and CVE-2026-59889 fixes in
jackson-databindjackson-databindis upgraded to 2.21.5 to address CVE-2026-59888 and CVE-2026-59889. The dependency update ships in this Keycloak release.securitymediumCVE-2026-45292 OpenTelemetry Java SDK memory allocation correction
CVE-2026-45292 corrects unbounded memory allocation in W3C Baggage Propagation in the OpenTelemetry Java SDK.
Check if affected (6)
securitycriticalCVE-2026-18963 reset-credentials flow bypass correction
Applies if you use the
reset-credentials flow.securityhighCVE-2026-15571 predictable account-linking hash correction
Applies if you use
oidc.securitymediumCVE-2026-14613 fine-grained admin permissions bypass correction
Applies if you use the
admin/fine-grained-permissionsAPI.- + 3 more on the release page
A security-focused maintenance release updates the Go build dependency to 1. and addresses standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins. Operators building their own binaries or images control the Go version used in those builds.
Action needed (1)
securitycritical
Go1.build dependency26. 6 OPA is built with
Go1., fixing standard-library vulnerabilities in code used by its HTTP handler and crypto builtins. The fixes address26. 6 GO-2026-5026,GO-2026-5972,GO-2026-6088,GO-2026-6089,GO-2026-6090,GO-2026-6091, andGO-2026-6218.
A corrective and performance-focused release with operator-visible default and constraint changes, deprecated flag removal, and dependency vulnerability fixes. It also expands scanning, output, registry, and MCP capabilities.
Action needed (3)
securityBatch dependency vulnerability fixes
Batch 1 and 2 dependency vulnerability fixes are included in this release.
breakingRegoV1 evaluation and v0 compatibility shim removal
Rego evaluation now uses RegoV1 and drops the v0 compatibility shim in this release.
breakingLoopback-only constraint
A loopback-only constraint is applied in this release.
Check if affected (3)
breakingOpt-in
pprof debug serverApplies if you enable the
pprof debug server.breaking
--frameworksdefault set to allApplies if you do not configure
--frameworks.breakingDeprecated flags removal
Applies if you configure
deprecated flags.
OpenFGA v1.18.3 includes a correctness fix for an experimental graph check. No operator-facing change details are included in the recorded release items.
Source ↗A maintenance release with security fixes and additional bug fixes. The security fixes require upgrading, and the ordinary bug fixes require no operator action beyond upgrading.
Check if affected (12)
securityhighCVE-2026-15573 unnormalized URI matching in
pathmatcherApplies if you use
pathmatcher.securityhighCVE-2026-15572 DCR protocol mapper type-swap policy
Applies if you use DCR.
securityhighCVE-2026-16442 SAML broker login restriction
Applies if you use the SAML broker.
- + 9 more on the release page
A maintenance release with diagnostic logging, experimental cache metric changes, and corrections for weighted-graph and tuple-validation defects. It also updates the Go toolchain and embedded grpc-health-probe in released images.
Action needed (1)
securityhigh
grpc-health-proberebuilt atv0.4. 53 The embedded
grpc-health-probeis rebuilt with Go 1.26.5 and bumped tov0.in released images. The update addresses the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822.4. 53
A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.
Action needed (3)
securityhigh
oras.update for GHSA-fxhp-mv3v-67qpland/oras-go/v2 oras.is updated fromland/oras-go/v2 2.to6. 1 2.to address GHSA-fxhp-mv3v-67qp.6. 2 breaking
ReadHeaderTimeoutdefaultAll HTTP servers now set
ReadHeaderTimeoutto32s.breakingPartial set and
-objectrule name conflictsThe AST rejects partial set and
-objectrules that share a name.
Check if affected (2)
securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
breakingStricter
:=safety checkingApplicability is not stated in the release notes.
cert-manager v1.21.1 is a maintenance release with fixes for regressions and updates to dependencies affected by reported security vulnerabilities. The dependency updates concern all installations, while the regression fixes address controller behavior and require no setup change.
Action needed (4)
securityThe
golang.dependency, updated to v0.40.0org/x/text The
golang.dependency is updated to v0.40.0 to fix a reported security vulnerability.org/x/text securityThe
google.dependency, updated to v1.82.1golang. org/grpc The
google.dependency is updated to v1.82.1 to fix a reported security vulnerability.golang. org/grpc securityThe
github.dependency, updated to v0.29.0com/google/cel-go The
github.dependency is updated to v0.29.0 to fix a reported security vulnerability.com/google/cel-go securityThe
go.dependency, updated to v1.44.0opentelemetry. io/otel The
go.dependency is updated to v1.44.0 to fix a reported security vulnerability.opentelemetry. io/otel
A release with a breaking authentication change and several operator-visible removals, alongside new integrations, APIs, and configuration capabilities. No security fixes or advisory identifiers are disclosed.
Check if affected (6)
breakingKBS client admin-token authentication
Applies if you use the
KBS client.breakingThe
CAA docker provider, removedApplies if you use the
CAA docker provider.breakingThe Fedora-based mkosi-built
CAA podvmimage, removedApplies if you use the Fedora-based mkosi-built
CAA podvmimage.- + 3 more on the release page
A feature and maintenance release that adds scanning, reporting, export, MCP, vulnerability-adaptor, and policy capabilities while correcting air-gapped, exception, scan, SARIF, and image-scan behavior. deploy-library now uses the embedded VAP bundle by default.
Check if affected (1)
breakingThe deploy-library bundle source
Applies if you use
deploy-library.
A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.
Action needed (1)
securitySecurity dependency updates
Security dependency updates from #16340 are backported to
release-1..18
Check if affected (1)
securityNamespace-boundary enforcement in
generator.apply() Applies if you use
generator..apply()
A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.
Action needed (2)
securityMigration from
github.tocom/docker/docker github.com/moby/moby Dependencies from
github.were migrated to theircom/docker/docker github.equivalents to resolve CVEs. The migration ships in this release.com/moby/moby breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.
Check if affected (1)
breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.
A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.
Action needed (1)
securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.
Check if affected (19)
securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use
manage-clients.securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use
OIDC.securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the
CIBAauthentication flow.- + 16 more on the release page
Plan ahead (4)
deprecatedThe
V1API, deprecatedApplies if you use
V1.deprecatedThe
Require Discoverable Credentialoption, deprecatedApplies if you configure the
Require Discoverable Credentialoption.deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
- + 1 more on the release page
A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.
Check if affected (5)
security
cert-manager-editaggregateClusterRolepermission removal, GHSA-8rvj-mm4h-c258Applies if you use the
cert-manager-editaggregateClusterRole.breaking
ObjectReferenceAPI removalApplies if you use
ObjectReferencein an API.breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of
prometheus.,servicemonitor. targetPort prometheus., orservicemonitor. path prometheus..podmonitor. path - + 2 more on the release page
Plan ahead (2)
deprecatedGateway API controller configuration fields
Applies if you configure any of
enableGatewayAPI,enableGatewayAPIListenerSet,gatewayAPI., orenabled gatewayAPI..enableListenerSet deprecated
ServerSideApplyfeature gate deprecation
OPA v1.18.2 is a patch release fixing a regression in opa fmt introduced in v1.18.0. The formatter again respects only newlines already present in source when formatting single-item arrays, objects, and sets.
This release removes an orphan CRD, adds operator-facing capabilities and output changes, and corrects runtime, validation, reporting, and scan-processing defects. No security advisories or explicitly exploitable vulnerabilities are disclosed.
Check if affected (1)
breaking
SecurityExceptionCRD removalApplies if you use the
SecurityExceptionCRD.
This release contains an experimental authorization evaluation change and an IP address matching semantics change. The remaining updates are diagnostic or storage-internal and do not require operator action.
Source ↗OPA v1.18.1 corrects a memory leak introduced in OPA v1.17.0. No individual change entries are included here.
Source ↗Version 26.6.4 is a security-focused Keycloak release with fixes for disclosed vulnerabilities. It also upgrades Quarkus to 3., an informational dependency change for operators.
Action needed (8)
securityhighCVE-2026-9099, group-admin escalation to realm-admin
Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.
securityhighCVE-2026-9086, cross-site scripting via URI validation bypass
Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.
securityhighCVE-2026-9795, improper scope mapping enforcement
Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.
securityhighCVE-2026-9800, policy enforcer URI comparison
Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.
securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass
Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.
securitymediumCVE-2026-9083, arbitrary filesystem path probing
Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.
securitymediumCVE-2026-9705, disabled client takeover
Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.
securitymediumCVE-2026-9799, UMA permission ticket bypass
Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.
A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.
Check if affected (1)
breakingThe
User-Agentheader formatApplies if you configure server-side log filters or WAF rules that exact-match the old string.
cert-manager v1. changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.
Action needed (2)
securityhigh
Gov1.with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-4250725. 11 Gois updated tov1.in cert-manager25. 11 v1.to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.19. 6 security
Go1.dependency upgrade25. 10 Gois upgraded to1.as part of the dependency updates in cert-manager25. 10 v1..19. 6
Check if affected (1)
securityReduced
cert-manager-editpermissions forChallengeandOrdercreation and updatesApplies if you use the
cert-manager-editaggregate ClusterRole for workflows that create or modifyChallengeorOrderresources.
A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.
Action needed (1)
securityhigh
Goupdated tov1.26. 4 Gois updated tov1.to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.26. 4
Check if affected (1)
securityThe
cert-manager-editaggregate ClusterRole permissionsApplicability is not stated in the release notes.
v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the
MySQL backend.securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
securityRequired OIDC issuer and audience configuration
Applies if
authn.is set tomethod oidc.
This release adds a capability to disable BPF iterators and fixes multiple BPF-iterator issues through a library dependency update. No security issue is disclosed.
Source ↗A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.
Action needed (1)
securitymediumThe
Go 1.build toolchain update26. 4 OPA is built with
Go 1.in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as26. 4 GO-2026-5037andGO-2026-5039.
OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.
Action needed (2)
securityThe
Gotoolchain, updated to1.26. 4 OpenFGA v1.17.1 updates the
Gotoolchain version to1.to address26. 4 Gostandard library vulnerabilities.security
grpc-health-probeupdated tov0.4. 52 Released images update
grpc-health-probetov0., rebuilt with4. 52 Go 1., so they no longer ship the Go standard library vulnerabilities addressed by this update.26. 4
A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.
Action needed (2)
securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where
lodashwas vulnerable to code injection.securitymediumCVE-2026-42581
NettyHTTP/1.0 smuggling sanitizationCVE-2026-42581 is addressed in
Netty, correcting HTTP/1.0TEandCLcoexistence that bypassed smuggling sanitization.
Check if affected (15)
securitymediumCVE-2026-7500 account API access control
Applies if you use
account/api.securitymediumCVE-2026-8922 OIDC token introspection
notBeforehandlingApplies if you use
oidc.securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use
authentication/webauthn.- + 12 more on the release page
OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.
Action needed (1)
securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with
TLVbinary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.
A release with Trustee, KBS, attestation, and platform-support changes, plus a security advisory fix. It also deprecates several CAA components and images planned for removal in 0.22.
Action needed (1)
securityGHSA-84rc-2q4r-45pc advisory fix
The release patches GHSA-84rc-2q4r-45pc in the guest components.
Plan ahead (4)
deprecated
packer-built CAA podvm imagedeprecationdeprecated since 0.17 · removal planned in 0.22Applies if you use the
packer-built CAA podvm image.deprecated
CAA docker providerdeprecationdeprecated since 0.20 · removal planned in 0.22Applies if you use the
CAA docker provider.deprecated
Fedora-based mkosi-built CAA podvm imagedeprecationdeprecated since 0.20 · removal planned in 0.22Applies if you use the
Fedora-based mkosi-built CAA podvm image.- + 1 more on the release page
A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.
Action needed (3)
securityDependency updates for security advisories
Dependencies are updated to address security advisories.
security
EnvFromclearing in container data removalremoveContainersDatanow clearsEnvFromto prevent secret name leakage.security
Env[].clearing in container data removalValueFrom removeContainersDataandremoveEphemeralContainersDatanow clearEnv[]..ValueFrom
Check if affected (3)
security
/v1/resultsaccess control hardeningApplies if you use
/v1/results.breakingThe
pdf/html outputdefault changed to file outputApplies if you use
pdf/html output.breakingThe
pushdefault changed to opt-inApplies if you use
push.
This is a broad operator-focused multi-cloud release with additions and extensions across AWS, Azure, and especially GCP. It also includes defect fixes and dependency updates, with no security advisories or explicit vulnerability disclosures noted.
Check if affected (1)
breakingThe
json-difffilter foraws., removediam-access-key Applies if your policies use the
json-difffilter onaws..iam-access-key
SPIRE v1.15.1 includes a security correction for Azure IMDS node attestation. The release also updates the golang. and golang. dependencies.
Check if affected (1)
securityAzure IMDS node attestation validation
Applies if you use the
azure_imdsserver node attestor plugin.
SPIRE v1.14.7 fixes a security vulnerability in Azure IMDS node attestation. It also updates the Go toolchain to 1.26.3 and updates three dependencies.
Check if affected (1)
securityThe
azure_imdsnode attestor validation is correctedApplies if you use the
azure_imdsserver node attestor plugin.
OpenFGA v1.16.1 includes a third-party dependency update for multiple CVEs in the Go standard library. It also corrects defects in the experimental weighted_graph_check behavior.
Action needed (1)
securityThe
grpc-health-probedependency updategrpc-health-probeis updated tov0.to address multiple CVEs in the Go standard library.4. 50
OPA v1.17.0 adds improved negation semantics, decision-log rule labels, published schemas, and API capabilities. It also includes correctness and performance improvements, removes two dependencies, and upgrades several others.
Source ↗A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.
Action needed (1)
breakinggRPC server support, removed
gRPC server support is removed in this release.
Check if affected (5)
securityPlugin library path traversal prevention
Applies if you configure the
plugin library path.breakingThe
gRPC output, removedApplies if you use the
gRPC output.breakingThe
gVisor engine, removedApplies if you use the
gVisor engine.- + 2 more on the release page
Release v1.16.0 adds datastore timeout configuration and additional tracing output. It also fixes defects in experimental weighted_graph_check and OIDC authentication, and updates the Go toolchain for standard-library vulnerability fixes.
Action needed (1)
securityThe
Gotoolchain, updated to 1.26.3The toolchain now uses
Goversion1.to address vulnerabilities in the26. 3 Gostandard library. This update ships in v1.16.0.
SPIRE v1.15.0 adds operator capabilities, changes CLI and output behavior, and updates dependencies. It also fixes correctness issues, with no security advisory or vulnerability disclosed.
Source ↗Aug 21, 2026 – May 19, 2026Older →