RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Apr 2026Clear ×
Kyvernov1.18.0SecurityApr 29, 2026
ACTION 4CHECK 2OTHER 102View full analysis

A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.

Action needed (4)

  • securityhighIntermediate certificate limit for CVE-2026-32280

    Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.

  • securityhighGo toolchain upgraded to 1.26.2 for CVE-2026-32283

    The Go toolchain is upgraded to 1.26.2 to fix CVE-2026-32283.

  • securitymediumgo-tuf/v2 upgraded to v2.4.1 for CVE-2026-24686

    go-tuf/v2 is upgraded to v2.4.1 to fix CVE-2026-24686.

  • securityStandard library CVE fixes

    Standard library CVEs are fixed in this release.

Check if affected (2)

  • breakingRestricted ConfigMap access for namespaced policies

    Applies if you use namespaced policies.

  • breakingFinalizers and uninstall workarounds removed

    Applies if uninstall runs.

Source ↗
SPIREv1.14.6SecurityApr 27, 2026
CHECK 2View full analysis

A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.

Check if affected (2)

  • securityThe aws_iid attestation identity verification

    Applies if you use the aws_iid server node attestor plugin.

  • securityJoin token data store deletion

    Applicability is not stated in the release notes.

Source ↗
SPIREv1.13.6SecurityApr 27, 2026
CHECK 1OTHER 1View full analysis

This is a security and correctness fix release for SPIRE node attestation. It addresses forged EC2 identity handling in aws_iid and concurrent join-token attestation behavior.

Check if affected (1)

  • securityCorrected aws_iid EC2 identity verification

    Applies if you use the aws_iid server node attestor plugin.

Source ↗
OpenFGAv1.15.0SecurityApr 27, 2026
ACTION 1OTHER 2View full analysis

This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.

Action needed (1)

  • securityThe Go toolchain version, updated to 1.26.2

    The toolchain Go version is updated to 1.26.2 to address Go standard library vulnerabilities documented in the Go 1.26.2 release notes.

Source ↗
Kyvernov1.16.4SecurityApr 23, 2026
ACTION 12CHECK 3OTHER 2View full analysis

A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.

Action needed (12)

  • securitycriticalCVE-2025-68121 fix

    This release fixes CVE-2025-68121.

  • securitycriticalCVE-2026-33186 fix

    This release fixes CVE-2026-33186.

  • securityhighCVE-2026-24051 fix

    This release fixes CVE-2026-24051 in the 1.16 release line.

  • securityhighThe github.com/docker/cli dependency update

    The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.

  • securityhighCVE-2025-66564 fix

    This release resolves CVE-2025-66564.

  • securitymediumThe sigstore/rekor dependency update to v1.5.1

    The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.

  • securitymediumThe go-tuf/v2 dependency update to v2.3.1

    The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.

  • securitymediumCVE-2026-22772 fix

    This release fixes CVE-2026-22772.

  • securitymediumThe go-tuf/v2 dependency update to v2.4.1

    The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.

  • securitylowCVE-2026-1229 fix

    This release fixes CVE-2026-1229 in the 1.16 release line.

  • securitylowCVE-2026-26958 fix

    This release fixes CVE-2026-26958.

  • securityStandard library CVE fixes

    This release fixes standard library CVEs.

Check if affected (3)

  • securitycriticalHTTP disabled by default in namespaced policies

    Applies if you configure namespaced policies.

  • securityCVE fixes for go < 1.25.8

    Applies if you depend on go < 1.25.8.

  • breakingRestricted configmap access for namespaced policies

    Applies if you configure namespaced policies.

Source ↗
Kyvernov1.17.2SecurityApr 23, 2026
ACTION 6CHECK 2OTHER 17View full analysis

A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.

Action needed (6)

  • securitycriticalCVE-2026-33186 correction

    The release fixes CVE-2026-33186.

  • securityhighCVE-2026-24051 correction

    The release fixes CVE-2026-24051 in the 1.17 release line.

  • securityhighCVE-2026-34986 correction

    The release fixes CVE-2026-34986.

  • securitylowCVE-2026-1229 correction

    The release fixes CVE-2026-1229.

  • securityCVES 2026-15558 correction

    The release includes the CVES 2026-15558 fix for 1.17.

  • securityGo version update

    The Go version was bumped to fix standard library CVEs.

Check if affected (2)

  • securitycriticalHTTP default for namespaced policies

    Applies if you configure namespaced policies.

  • breakingConfigmap access for namespaced policies

    Applies if you configure namespaced policies.

Source ↗
cert-managerv1.19.5SecurityApr 21, 2026
ACTION 2OTHER 1View full analysis

This release contains security-related updates to Go dependencies and the Go toolchain. It concerns deployments that rely on the affected dependencies or the bundled Go toolchain.

Action needed (2)

  • securityGo dependencies with reported vulnerabilities updated

    Go dependencies with reported vulnerabilities are updated in cert-manager v1.19.5.

  • securityThe go toolchain updated to 1.25.8

    The go toolchain is updated to 1.25.8 in cert-manager v1.19.5 to address reported vulnerabilities.

Source ↗
Keycloak26.6.1SecurityApr 15, 2026
ACTION 2OTHER 9View full analysis

Keycloak 26.6.1 is a maintenance release with two described security fixes in the core. It also contains dependency updates, an enhancement, and bug fixes.

Action needed (2)

  • securitymediumCVE-2026-4366, blind server-side request forgery via HTTP redirect handling

    Keycloak 26.6.1 fixes blind server-side request forgery through HTTP redirect handling in core.

  • securitylowCVE-2026-4633, user enumeration via identity-first login

    Keycloak 26.6.1 fixes user enumeration through identity-first login in core.

Source ↗
cert-managerv1.20.2SecurityApr 11, 2026
ACTION 1OTHER 2View full analysis

cert-manager v1.20.2 fixes invalid Helm YAML generation and updates Go to 1.26.2. It also includes a security-related update to Go dependencies with reported vulnerabilities.

Action needed (1)

  • securityGo dependency updates

    Go dependencies with reported vulnerabilities were updated in cert-manager v1.20.2. No advisory identifier is provided for this update.

Source ↗
OpenFGAv1.14.1SecurityApr 10, 2026
CHECK 2OTHER 3View full analysis

A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.

Check if affected (2)

  • securityAuthZEN discovery metadata endpoint URLs

    Applies if authzen.baseURL is configured.

  • securityThe github.com/docker/docker test dependency, replaced with Moby

    Applies if tests run.

Source ↗
SPIREv1.14.5SecurityApr 8, 2026
ACTION 1View full analysis

This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.

Action needed (1)

Source ↗
SPIREv1.13.5SecurityApr 8, 2026
ACTION 1View full analysis

This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.

Action needed (1)

Source ↗
Open Policy Agent (OPA)v1.15.2SecurityApr 8, 2026
ACTION 1View full analysis

This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.

Action needed (1)

  • securityThe Go toolchain, updated to 1.26.2

    The Go version used to build OPA binaries and images is updated to 1.26.2. This Go version contains multiple security fixes.

Source ↗
Keycloak26.6.0SecurityApr 8, 2026
ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

  • securitySeparate password and OTP brute force protection

    Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.

  • securityResourceAdminManager URL construction validation

    URL construction in ResourceAdminManager is validated against matrix parameter injection.

  • securityClient retrieval anti-ID phishing check

    Client retrieval now includes the missing anti-ID phishing check.

  • breakingZero-downtime patch releases enabled by default

    Zero-downtime patch releases are now promoted to supported and enabled by default.

  • breaking--truststore-kubernetes-enabled enabled by default

    The behavior controlled by --truststore-kubernetes-enabled is enabled by default.

  • breakingTen-second default not-before validation

    The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

  • securityWorkflows admin permission boundaries

    Applies if you use Workflows.

  • securityOrganizations login IdP alias disclosure

    Applies if you use Organizations.

  • securitySCIM PUT body ID override protection

    Applies if you use SCIM.

  • + 4 more on the release page

Plan ahead (1)

  • deprecatedToken Exchange v1 deprecation

    Applies if you use Token Exchange v1.

Source ↗
OpenFGAv1.14.0SecurityApr 3, 2026
ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

  • securitymediumBatchCheck policy enforcement fix for CVE-2026-34972

    The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

  • breakingPlayground authentication limited to none

    Applies if the Playground runs with preshared key authentication.

Plan ahead (2)

  • deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced

    Applies if you use the built-in OpenFGA Playground.

  • deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation

    Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.

Source ↗
Keycloak26.5.7SecurityApr 2, 2026
ACTION 1CHECK 6OTHER 2View full analysis

A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.

Action needed (1)

  • securitymediumCVE-2026-1002 static handler component cache

    CVE-2026-1002 fixes a flaw in the io.vertx/vertx-core static handler component cache that could deny access to static files.

Check if affected (6)

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023