Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Keycloak26.6.2SecurityMay 19, 2026

ACTION 6CHECK 12OTHER 13View full analysis

A maintenance release with numerous disclosed security fixes, dependency updates, enhancements, and bug fixes. It also corrects forced object deletion during the operator upgrade path.

Action needed (6)

securityhighCVE-2026-33871: HTTP/2 CONTINUATION frame flood denial of service
The release fixes the HTTP/2 CONTINUATION frame flood denial-of-service issue identified by CVE-2026-33871.
securityhighCVE-2026-33870: HTTP request smuggling through chunked extension parsing
The release corrects the HTTP request smuggling primitive caused by chunked extension quoted-string parsing, identified by CVE-2026-33870.
securityhighBouncycastle updates for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598
The release updates bouncycastle for CVE-2026-0636, CVE-2026-3505, and CVE-2026-5598.
securityhighCVE-2026-7504: Redirect URI validation bypass
The release corrects the redirect URI validation bypass in Keycloak, identified by CVE-2026-7504.
securitymediumCVE-2026-5588: Bouncy Castle bcpkix cryptographic algorithm vulnerability
The release updates the bcpkix modules affected by the broken or risky cryptographic algorithm vulnerability in the Bouncy Castle Crypto Package for Java, identified by CVE-2026-5588.
securityPermission and policy call ordering in admin/api
The release corrects the ordering of permission and policy calls in admin/api that led to exposure of a client ID.

Check if affected (12)

securityhighCVE-2026-7307: Denial of service at the /saml endpoint
Applies if you use /saml.
securityhighCVE-2026-7571: Access token disclosure and implicit flow bypass
Applies if you use implicit flow.
securityhighCVE-2026-7507: Session fixation in the OIDC login flow
Applies if you use OIDC login flow.
+ 9 more on the release page

Source ↗

Kyvernov1.18.1SecurityMay 18, 2026

OTHER 2View full analysis

Kyverno v1.18.1 is a bug-fix release focused on policy processing. It addresses behavior in resource generation and mutate-existing policy handling.

Source ↗

The Update Framework (TUF)v7.0.0SecurityMay 18, 2026

ACTION 1CHECK 1PLAN 1View full analysis

A release focused on a security fix and API evolution. It tightens the Updater() contract and begins preparation for removal of an existing module.

Action needed (1)

securitymediumGHSA-qp9x-wp8f-qgjj fixed
The release fixes GHSA-qp9x-wp8f-qgjj.

Check if affected (1)

breakingThe Updater() bootstrap argument, now required
Applies if you use Updater().

Plan ahead (1)

deprecatedPreparation for removal of securesystemslib.hash
Applies if you use securesystemslib.hash.

Source ↗

Open Policy Agent (OPA)v1.16.2SecurityMay 12, 2026

ACTION 1View full analysis

OPA v1.16.2 is a security-focused maintenance release. It updates the Go version used to build OPA binaries and images to 1.26.3 to address vulnerabilities.

Action needed (1)

securityThe Go build version, updated to 1.26.3
The version of Go used to build OPA binaries and images is updated to 1.26.3 to address vulnerabilities.

Source ↗

Kubescapev4.0.8SecurityMay 8, 2026

OTHER 11View full analysis

Kubescape v4.0.8 adds a CLI flag and includes multiple correctness fixes, with most changes focused on VAP validation and output handling. No security advisories or security-specific fixes are disclosed.

Source ↗

Kubescapev4.0.7SecurityMay 8, 2026

CHECK 3OTHER 29View full analysis

A maintenance release with operator-facing correctness fixes, new control and TLS configuration capabilities, narrower CRD scan-mode support, and interface simplifications. It also improves validation and error reporting, with no security advisories or vulnerability disclosures.

Check if affected (3)

breakingprotobuf content type removal
Applies if you use protobuf content type.
breakingSidecar requirement removal
Applies if you use a sidecar.
breakingThe --output flag, removed
Applies if you configure --output.

Source ↗

OpenFGAv1.15.1SecurityMay 6, 2026

OTHER 5View full analysis

OpenFGA v1.15.1 is a correctness-focused release. The available release information points to fixes in command error handling, object listing, experimental graph checks, bounded tuple reads, and check request handling.

Source ↗

Confidential Containersv0.20.0SecurityMay 5, 2026

ACTION 1PLAN 3OTHER 12View full analysis

Confidential Containers v0.20.0 combines operator-visible capability and compatibility updates with deprecations of several image and provider paths. It also includes a security fix identified by GHSA-q49m-57vm-c8cc.

Action needed (1)

securityhighGHSA-q49m-57vm-c8cc security fix
The release includes a fix for the security issue identified by GHSA-q49m-57vm-c8cc.

Plan ahead (3)

deprecatedThe Docker CAA provider, deprecatedremoval date not announced
Applies if you use the Docker CAA provider.
breakingThe Fedora-based mkosi CAA podvm image, deprecatedremoval date not announced
Applies if you use the Fedora-based mkosi CAA podvm image.
deprecatedSupport for packer images, deprecatedremoval date not announced
Applies if you use packer images.

Source ↗

in-totov3.1.0SecurityMay 4, 2026

OTHER 1View full analysis

This release includes an operator-facing command-line behavior change, along with internal or build-related updates. No detailed change entry is available here for the operator-facing behavior.

Source ↗

Kubescapev4.0.6SecurityMay 4, 2026

OTHER 30View full analysis

Kubescape v4.0.6 includes dependency upgrades, new Helm and Kustomize support, scan-metadata capabilities, and correctness fixes. No security advisory or explicitly described vulnerability is present.

Source ↗

Open Policy Agent (OPA)v1.16.1SecurityMay 1, 2026

OTHER 1View full analysis

This patch release fixes a plugin-manager regression that may cause the service to hang during shutdown. The change is relevant to deployments using the affected plugin manager behavior.

Source ↗

Open Policy Agent (OPA)v1.16.0SecurityApr 30, 2026

ACTION 1OTHER 38View full analysis

OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.

Action needed (1)

breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.

Source ↗

Kyvernov1.18.0SecurityApr 29, 2026

ACTION 4CHECK 2OTHER 102View full analysis

A substantial feature and maintenance release with new operator capabilities plus configuration, Helm, and CLI improvements. It also includes defect, output, dependency, and security fixes, including remediation for several CVE-related issues.

Action needed (4)

securityhighIntermediate certificate limit for CVE-2026-32280
Intermediate certificates are limited to mitigate CVE-2026-32280 in this release.
securityhighGo toolchain upgraded to 1.26.2 for CVE-2026-32283
The Go toolchain is upgraded to 1.26.2 to fix CVE-2026-32283.
securitymediumgo-tuf/v2 upgraded to v2.4.1 for CVE-2026-24686
go-tuf/v2 is upgraded to v2.4.1 to fix CVE-2026-24686.
securityStandard library CVE fixes
Standard library CVEs are fixed in this release.

Check if affected (2)

breakingRestricted ConfigMap access for namespaced policies
Applies if you use namespaced policies.
breakingFinalizers and uninstall workarounds removed
Applies if uninstall runs.

Source ↗

SPIREv1.14.6SecurityApr 27, 2026

CHECK 2View full analysis

A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.

Check if affected (2)

securityThe aws_iid attestation identity verification
Applies if you use the aws_iid server node attestor plugin.
securityJoin token data store deletion
Applicability is not stated in the release notes.

Source ↗

SPIREv1.13.6SecurityApr 27, 2026

CHECK 1OTHER 1View full analysis

This is a security and correctness fix release for SPIRE node attestation. It addresses forged EC2 identity handling in aws_iid and concurrent join-token attestation behavior.

Check if affected (1)

securityCorrected aws_iid EC2 identity verification
Applies if you use the aws_iid server node attestor plugin.

Source ↗

OpenFGAv1.15.0SecurityApr 27, 2026

ACTION 1OTHER 2View full analysis

This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.

Action needed (1)

securityThe Go toolchain version, updated to 1.26.2
The toolchain Go version is updated to 1.26.2 to address Go standard library vulnerabilities documented in the Go 1.26.2 release notes.

Source ↗

Kyvernov1.16.4SecurityApr 23, 2026

ACTION 12CHECK 3OTHER 2View full analysis

A security-fix release with fixes for multiple CVEs and updates to affected dependencies. It also changes the default HTTP behavior and restricts configmap access for namespaced policies.

Action needed (12)

securitycriticalCVE-2025-68121 fix
This release fixes CVE-2025-68121.
securitycriticalCVE-2026-33186 fix
This release fixes CVE-2026-33186.
securityhighCVE-2026-24051 fix
This release fixes CVE-2026-24051 in the 1.16 release line.
securityhighThe github.com/docker/cli dependency update
The github.com/docker/cli dependency is updated to resolve CVE-2025-15558.
securityhighCVE-2025-66564 fix
This release resolves CVE-2025-66564.
securitymediumThe sigstore/rekor dependency update to v1.5.1
The sigstore/rekor dependency is updated to v1.5.1 to fix CVE-2026-23831.
securitymediumThe go-tuf/v2 dependency update to v2.3.1
The go-tuf/v2 dependency is updated to v2.3.1 to address CVE-2026-23992.
securitymediumCVE-2026-22772 fix
This release fixes CVE-2026-22772.
securitymediumThe go-tuf/v2 dependency update to v2.4.1
The go-tuf/v2 dependency is updated to v2.4.1 to patch CVE-2026-24686.
securitylowCVE-2026-1229 fix
This release fixes CVE-2026-1229 in the 1.16 release line.
securitylowCVE-2026-26958 fix
This release fixes CVE-2026-26958.
securityStandard library CVE fixes
This release fixes standard library CVEs.

Check if affected (3)

securitycriticalHTTP disabled by default in namespaced policies
Applies if you configure namespaced policies.
securityCVE fixes for go < 1.25.8
Applies if you depend on go < 1.25.8.
breakingRestricted configmap access for namespaced policies
Applies if you configure namespaced policies.

Source ↗

Kyvernov1.17.2SecurityApr 23, 2026

ACTION 6CHECK 2OTHER 17View full analysis

A maintenance release with multiple correctness fixes and security fixes, including changes for several CVEs and standard library CVEs. Operators should account for the changed HTTP default and narrower configmap access in addition to the security fixes.

Action needed (6)

securitycriticalCVE-2026-33186 correction
The release fixes CVE-2026-33186.
securityhighCVE-2026-24051 correction
The release fixes CVE-2026-24051 in the 1.17 release line.
securityhighCVE-2026-34986 correction
The release fixes CVE-2026-34986.
securitylowCVE-2026-1229 correction
The release fixes CVE-2026-1229.
securityCVES 2026-15558 correction
The release includes the CVES 2026-15558 fix for 1.17.
securityGo version update
The Go version was bumped to fix standard library CVEs.

Check if affected (2)

securitycriticalHTTP default for namespaced policies
Applies if you configure namespaced policies.
breakingConfigmap access for namespaced policies
Applies if you configure namespaced policies.

Source ↗

cert-managerv1.19.5SecurityApr 21, 2026

ACTION 2OTHER 1View full analysis

This release contains security-related updates to Go dependencies and the Go toolchain. It concerns deployments that rely on the affected dependencies or the bundled Go toolchain.

Action needed (2)

securityGo dependencies with reported vulnerabilities updated
Go dependencies with reported vulnerabilities are updated in cert-manager v1.19.5.
securityThe go toolchain updated to 1.25.8
The go toolchain is updated to 1.25.8 in cert-manager v1.19.5 to address reported vulnerabilities.

Source ↗

Kubescapev4.0.5SecurityApr 17, 2026

OTHER 1View full analysis

This release contains an operator-facing dependency and toolchain update. The available release information does not specify the affected Go version or dependencies.

Source ↗

Kubescapev4.0.4SecurityApr 17, 2026

OTHER 18View full analysis

Kubescape v4.0.4 contains dependency updates, ordinary correctness improvements, and a logging dependency update. No security advisory or explicitly security-related flaw is disclosed.

Source ↗

Keycloak26.6.1SecurityApr 15, 2026

ACTION 2OTHER 9View full analysis

Keycloak 26.6.1 is a maintenance release with two described security fixes in the core. It also contains dependency updates, an enhancement, and bug fixes.

Action needed (2)

securitymediumCVE-2026-4366, blind server-side request forgery via HTTP redirect handling
Keycloak 26.6.1 fixes blind server-side request forgery through HTTP redirect handling in core.
securitylowCVE-2026-4633, user enumeration via identity-first login
Keycloak 26.6.1 fixes user enumeration through identity-first login in core.

Source ↗

OpenFGAv1.14.2SecurityApr 14, 2026

OTHER 1View full analysis

This release contains an operator-facing bug fix in OpenFGA. The recorded note tail refers to delimiter handling in the experimental weighted_graph_check and added validation in v2Check.

Source ↗

cert-managerv1.20.2SecurityApr 11, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.2 fixes invalid Helm YAML generation and updates Go to 1.26.2. It also includes a security-related update to Go dependencies with reported vulnerabilities.

Action needed (1)

securityGo dependency updates
Go dependencies with reported vulnerabilities were updated in cert-manager v1.20.2. No advisory identifier is provided for this update.

Source ↗

OpenFGAv1.14.1SecurityApr 10, 2026

CHECK 2OTHER 3View full analysis

A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.

Check if affected (2)

securityAuthZEN discovery metadata endpoint URLs
Applies if authzen.baseURL is configured.
securityThe github.com/docker/docker test dependency, replaced with Moby
Applies if tests run.

Source ↗

Falco0.43.1SecurityApr 9, 2026

OTHER 2View full analysis

Falco 0.43.1 updates build component versions. The release note discloses no security changes.

Source ↗

SPIREv1.14.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.

Action needed (1)

securitycriticalThe Go toolchain, updated to 1.26.2
The release updates the Go toolchain to 1.26.2 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.

Source ↗

SPIREv1.13.5SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.

Action needed (1)

securitycriticalThe Go dependency, upgraded to 1.25.9
The release upgrades Go to 1.25.9 to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.

Source ↗

Open Policy Agent (OPA)v1.15.2SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.

Action needed (1)

securityThe Go toolchain, updated to 1.26.2
The Go version used to build OPA binaries and images is updated to 1.26.2. This Go version contains multiple security fixes.

Source ↗

Keycloak26.6.0SecurityApr 8, 2026

ACTION 6CHECK 7PLAN 1OTHER 269View full analysis

A substantial operator-facing feature and maintenance release adds new capabilities, configuration and deployment options, performance improvements, and many bug fixes. It also changes selected defaults, deprecates Token Exchange v1, and includes security and correctness fixes for authorization, identity and URL handling, SCIM, anti-phishing checks, and UMA token validation.

Action needed (6)

securitySeparate password and OTP brute force protection
Password and OTP brute force protection are now separate by default to prevent OTP bypass attacks.
securityResourceAdminManager URL construction validation
URL construction in ResourceAdminManager is validated against matrix parameter injection.
securityClient retrieval anti-ID phishing check
Client retrieval now includes the missing anti-ID phishing check.
breakingZero-downtime patch releases enabled by default
Zero-downtime patch releases are now promoted to supported and enabled by default.
breaking--truststore-kubernetes-enabled enabled by default
The behavior controlled by --truststore-kubernetes-enabled is enabled by default.
breakingTen-second default not-before validation
The default not-before validation period is now 10 seconds instead of 0.

Check if affected (7)

securityWorkflows admin permission boundaries
Applies if you use Workflows.
securityOrganizations login IdP alias disclosure
Applies if you use Organizations.
securitySCIM PUT body ID override protection
Applies if you use SCIM.
+ 4 more on the release page

Plan ahead (1)

deprecatedToken Exchange v1 deprecation
Applies if you use Token Exchange v1.

Source ↗

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.

Source ↗

Keycloak26.5.7SecurityApr 2, 2026

ACTION 1CHECK 6OTHER 2View full analysis

A security maintenance release fixes seven disclosed vulnerabilities. It also upgrades Quarkus and corrects an error caused by requests without a Host header.

Action needed (1)

securitymediumCVE-2026-1002 static handler component cache
CVE-2026-1002 fixes a flaw in the io.vertx/vertx-core static handler component cache that could deny access to static files.

Check if affected (6)

securityhighCVE-2026-4634 scope processing
Applies if you use Scope Processing.
securityhighCVE-2026-4636 UMA policy resource injection
Applies if you use UMA.
securityhighCVE-2026-3872 OIDC redirect URI validation
Applies if you use OIDC.
+ 3 more on the release page

Source ↗

Confidential Containersv0.19.0SecurityMar 30, 2026

CHECK 5PLAN 1OTHER 10View full analysis

A release that narrows supported environments and installation paths while adding storage, attestation, GPU, API, signature, and image-handling capabilities. It also updates guest and image handling, including sealed-secret signatures, cosign signatures with newlines, in-memory LUKS headers, and improved Vault/OpenBao support.

Check if affected (5)

breakingGo support in CDH removed
Applies if you use CDH.
breakingCanonical TDX Tech preview support removed
Applies if you use Canonical TDX Tech preview.
breakingUbuntu version requirement
Applies if you use Ubuntu 24.04.4 (linux-image-generic-hwe-24.04) or 25.10.
+ 2 more on the release page

Plan ahead (1)

deprecatedpacker images support, planned for removalremoval date not announced
Applies if you use packer images.

Source ↗

Open Policy Agent (OPA)v1.15.1SecurityMar 30, 2026

OTHER 1View full analysis

OPA v1.15.1 is a patch release that corrects a backwards-incompatible v1/logging.Logger interface change from v1.15.0. The fix concerns Go module users with custom Logger implementations; binary and Docker image behavior is unchanged.

Source ↗

cert-managerv1.20.1SecurityMar 27, 2026

ACTION 1OTHER 2View full analysis

cert-manager v1.20.1 contains bug corrections and a security-related dependency update. The gRPC vulnerability details are limited to the scanner reports, which state that it does not affect cert-manager.

Action needed (1)

securityThe google.golang.org/grpc dependency update
The google.golang.org/grpc dependency is bumped in cert-manager v1.20.1 to address a vulnerability reported by scanners. The report states that the vulnerability does not affect cert-manager.

Source ↗

Open Policy Agent (OPA)v1.15.0SecurityMar 26, 2026

CHECK 1OTHER 16View full analysis

OPA v1.15.0 adds pluggable logging and AWS web-identity signing support, changes the custom HTTPAuthPlugin lifecycle contract, and adds TLS certificate reread configuration. It also includes correctness fixes and dependency updates; no security advisories or vulnerability disclosures are stated.

Check if affected (1)

breakingCustom HTTPAuthPlugin lifecycle contract
Applies if you use custom HTTPAuthPlugin implementations.

Source ↗

OpenFGAv1.13.1SecurityMar 24, 2026

CHECK 1View full analysis

A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.

Check if affected (1)

securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed
Applies if Check requests use conditions and caching is enabled.

Source ↗

OpenFGAv1.13.0SecurityMar 23, 2026

OTHER 2View full analysis

This release adds experimental AuthZen 1.0 support and changes observability output for list-objects operations. It also includes fixes for recoverable panics.

Source ↗

SPIREv1.14.4SecurityMar 19, 2026

OTHER 2View full analysis

This release fixes an agent version-reporting defect during re-attestation or SVID renewal. The recorded release note describes the agent's startup version being replaced by an empty string during that process.

Source ↗

OpenFGAv1.12.1SecurityMar 19, 2026

OTHER 2View full analysis

OpenFGA v1.12.1 contains a dependency version update and a correction to OTLP endpoint handling. The available release information points to changes that affect operator configuration and dependency versions, while internal implementation refactors do not affect users directly.

Source ↗

← NewerMay 19, 2026 – Mar 19, 2026Older →

Browse by month