Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×

Kubescapev4.0.9SecurityMay 29, 2026

ACTION 3CHECK 3OTHER 105View full analysis

A broad maintenance release with correctness fixes, new CLI and reporting capabilities, anonymization updates, a performance improvement, added validation, and dependency refreshes. It also includes security fixes alongside changes to output and push defaults.

Action needed (3)

securityDependency updates for security advisories
Dependencies are updated to address security advisories.
securityEnvFrom clearing in container data removal
removeContainersData now clears EnvFrom to prevent secret name leakage.
securityEnv[].ValueFrom clearing in container data removal
removeContainersData and removeEphemeralContainersData now clear Env[].ValueFrom.

Check if affected (3)

security/v1/results access control hardening
Applies if you use /v1/results.
breakingThe pdf/html output default changed to file output
Applies if you use pdf/html output.
breakingThe push default changed to opt-in
Applies if you use push.

Source ↗

Cloud Custodian0.9.51.0SecurityMay 28, 2026

CHECK 1OTHER 90View full analysis

This is a broad operator-focused multi-cloud release with additions and extensions across AWS, Azure, and especially GCP. It also includes defect fixes and dependency updates, with no security advisories or explicit vulnerability disclosures noted.

Check if affected (1)

breakingThe json-diff filter for aws.iam-access-key, removed
Applies if your policies use the json-diff filter on aws.iam-access-key.

Source ↗

Falco0.44.0SecurityMay 26, 2026

ACTION 1CHECK 5OTHER 34View full analysis

A release that removes several supported engines and outputs and restricts falco-webui access. It also adds rule and configuration capabilities, includes defect fixes and dependency updates, and discloses no security advisory.

Action needed (1)

breakinggRPC server support, removed
gRPC server support is removed in this release.

Check if affected (5)

securityPlugin library path traversal prevention
Applies if you configure the plugin library path.
breakingThe gRPC output, removed
Applies if you use the gRPC output.
breakingThe gVisor engine, removed
Applies if you use the gVisor engine.
+ 2 more on the release page

Source ↗

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
+ 9 more on the release page

Source ↗

The Update Framework (TUF)v7.0.0SecurityMay 18, 2026

ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

securitymediumGHSA-qp9x-wp8f-qgjj fixed
The release fixes GHSA-qp9x-wp8f-qgjj.

Check if affected (1)

breakingThe Updater() bootstrap argument, now required
Applies if you use Updater().

Plan ahead (1)

deprecatedPreparation for removal of securesystemslib.hash
Applies if you use securesystemslib.hash.

Source ↗

Kubescapev4.0.7SecurityMay 8, 2026

CHECK 3OTHER 29View full analysis

A maintenance release with operator-facing correctness fixes, new control and TLS configuration capabilities, narrower CRD scan-mode support, and interface simplifications. It also improves validation and error reporting, with no security advisories or vulnerability disclosures.

Check if affected (3)

breakingprotobuf content type removal
Applies if you use protobuf content type.
breakingSidecar requirement removal
Applies if you use a sidecar.
breakingThe --output flag, removed
Applies if you configure --output.

Source ↗

Confidential Containersv0.20.0SecurityMay 5, 2026

ACTION 1PLAN 3OTHER 12View full analysis

Confidential Containers v0.20.0 combines operator-visible capability and compatibility updates with deprecations of several image and provider paths. It also includes a security fix identified by GHSA-q49m-57vm-c8cc.

Action needed (1)

securityhighGHSA-q49m-57vm-c8cc security fix
The release includes a fix for the security issue identified by GHSA-q49m-57vm-c8cc.

Plan ahead (3)

deprecatedThe Docker CAA provider, deprecatedremoval date not announced
Applies if you use the Docker CAA provider.
breakingThe Fedora-based mkosi CAA podvm image, deprecatedremoval date not announced
Applies if you use the Fedora-based mkosi CAA podvm image.
deprecatedSupport for packer images, deprecatedremoval date not announced
Applies if you use packer images.

Source ↗

Browse by month