AI-analyzed release notes for CNCF graduated and incubating projects.
This release removes an orphan CRD, adds operator-facing capabilities and output changes, and corrects runtime, validation, reporting, and scan-processing defects. No security advisories or explicitly exploitable vulnerabilities are disclosed.
Check if affected (1)
breakingSecurityException CRD removal
Applies if you use the SecurityException CRD.
A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.
Check if affected (1)
breakingThe User-Agent header format
Applies if you configure server-side log filters or WAF rules that exact-match the old string.
A security-focused maintenance release with fixes spanning OIDC, authorization and account APIs, identity features, federation, WebAuthn, SAML, Netty, and lodash. It also updates dependencies and adds startup and SPI behavior alongside numerous correctness fixes.
Action needed (2)
securityhighCVE-2026-4800 lodash code injection
CVE-2026-4800 is addressed in the account UI, where lodash was vulnerable to code injection.
securitymediumCVE-2026-42581 Netty HTTP/1.0 smuggling sanitization
CVE-2026-42581 is addressed in Netty, correcting HTTP/1.0 TE and CL coexistence that bypassed smuggling sanitization.
Check if affected (15)
securitymediumCVE-2026-7500 account API access control
Applies if you use account/api.
securitymediumCVE-2026-8922 OIDC token introspection notBefore handling
Applies if you use oidc.
securitymediumCVE-2026-8830 server-side WebAuthn validation
Applies if you use authentication/webauthn.
