AI-analyzed release notes for CNCF graduated and incubating projects.
cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.
Action needed (1)
securityThe google. dependency update
The google. dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.
A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.
Check if affected (1)
securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed
Applies if Check requests use conditions and caching is enabled.
A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.
Check if affected (8)
securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration
Applies if you use OIDC Dynamic Client Registration.
securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion
Applicability is not stated in the release notes.
securitymediumCVE-2026-3121, privilege escalation via manage-clients permission
Applies if you configure manage-clients permission.
A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.
Action needed (1)
securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.
Check if affected (1)
securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.
A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.
Action needed (2)
securityhighGo toolchain version 1.
The Go toolchain is updated to version 1. to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.
Check if affected (1)
breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.
This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.
Action needed (2)
securityhighGo v1. update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1. to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.
Check if affected (4)
securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.
Action needed (1)
securityGolang standard library dependency updates
This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.
This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.
Check if affected (4)
securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue fixed
Applies if you use http_challenge.
securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed
Applies if you use x509pop.
A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.
Check if affected (2)
securityThe http_challenge server node attestor plugin, SSRF issue corrected
Applies if you use the http_challenge server node attestor plugin.
securityThe x509pop server node attestor plugin, CPU consumption issue corrected
Applies if you use the x509pop server node attestor plugin.
