Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Keycloak26.5.6SecurityMar 19, 2026

CHECK 8OTHER 10View full analysis

A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.

Check if affected (8)

securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration
Applies if you use OIDC Dynamic Client Registration.
securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion
Applicability is not stated in the release notes.
securitymediumCVE-2026-3121, privilege escalation via manage-clients permission
Applies if you configure manage-clients permission.
+ 5 more on the release page

Source ↗

Cloud Custodian0.9.50.0SecurityMar 18, 2026

OTHER 56View full analysis

Cloud Custodian 0.9.50.0 adds operator-facing resources, filters, actions, and configuration options across AWS, Azure, and GCP. It also corrects provider-specific defects and changes existing filtering and policy behavior, with no security advisories or explicit vulnerability fixes described.

Source ↗

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.

Source ↗

Kubescapev4.0.3SecurityMar 17, 2026

OTHER 3View full analysis

Kubescape v4.0.3 is a maintenance release with changes that affect command-line use and runtime correctness. It also updates a dependency, while other release-note entries are internal or administrative.

Source ↗

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Source ↗

cert-managerv1.20.0SecurityMar 10, 2026

ACTION 2CHECK 4OTHER 26View full analysis

This release adds Helm, API, solver, and feature-gate capabilities while changing defaults and accepted behavior. It also corrects bugs and includes security fixes in the cert-manager controller and Go.

Action needed (2)

securityhighGo v1.25.5 update for CVE-2025-61727 and CVE-2025-61729
Go is updated to v1.25.5 to fix CVE-2025-61727 and CVE-2025-61729.
breakingIssuer reference kind and group defaults, reverted
The default issuer reference kind and group values are reverted to the behavior before 0.19.0.

Check if affected (4)

securityPotential cert-manager controller panic from cached DNS responses
Applicability is not stated in the release notes.
breakingThe OtherNames feature, enabled by default
Applies if you use the OtherNames feature.
breakingDefault container user and group IDs
Applies if you do not configure the default container user (UID) or do not configure the default container group (GID).
+ 1 more on the release page

Source ↗

Open Policy Agent (OPA)v1.14.1SecurityMar 9, 2026

ACTION 1OTHER 3View full analysis

OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.

Action needed (1)

securityGolang standard library dependency updates
This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.

Source ↗

Keycloak26.5.5SecurityMar 5, 2026

CHECK 4View full analysis

This release fixes four disclosed security vulnerabilities involving SAML and identity brokering. The corrections address authentication, identity provider enforcement, broker login, and encrypted assertion handling.

Check if affected (4)

securityhighCVE-2026-3047 SAML broker authentication bypass
Applies if you use SAML broker and configure a disabled SAML client.
securityhighCVE-2026-3009 disabled identity provider enforcement
Applies if you configure Disabled Identity Provider.
securityhighCVE-2026-2603 disabled SAML IdP broker login
Applies if you configure Disabled SAML IdP.
+ 1 more on the release page

Source ↗

SPIREv1.14.2SecurityMar 3, 2026

CHECK 2View full analysis

Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.

Check if affected (2)

securityThe http_challenge server node attestor plugin, SSRF issue fixed
Applies if you use http_challenge.
securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed
Applies if you use x509pop.

Source ↗

SPIREv1.13.4SecurityMar 3, 2026

CHECK 2View full analysis

A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.

Check if affected (2)

securityThe http_challenge server node attestor plugin, SSRF issue corrected
Applies if you use the http_challenge server node attestor plugin.
securityThe x509pop server node attestor plugin, CPU consumption issue corrected
Applies if you use the x509pop server node attestor plugin.

Source ↗

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).

Source ↗

cert-managerv1.18.6SecurityFeb 24, 2026

ACTION 2View full analysis

cert-manager v1.18.6 is a patch release focused on fixing reported vulnerabilities, including CVE-2025-68121, through a Go toolchain bump. CVE-2026-24051 is explicitly stated not to affect cert-manager.

Action needed (2)

securitycriticalCVE-2025-68121 vulnerability fix
The v1.18.6 patch release fixes reported vulnerabilities, most notably CVE-2025-68121, in cert-manager.
securitycriticalGo toolchain bump for CVE-2025-68121
The Go toolchain is bumped in cert-manager v1.18.6 to address CVE-2025-68121.

Source ↗

cert-managerv1.19.4SecurityFeb 24, 2026

ACTION 3OTHER 1View full analysis

cert-manager v1.19.4 is a patch release focused on reported vulnerabilities and dependency updates. It includes fixes for CVE-2026-24051, CVE-2025-68121, and GO-2026-4394.

Action needed (3)

securitycriticalThe go dependency update
The go dependency is bumped in cert-manager v1.19.4 to address CVE-2025-68121.
securityhighcert-manager v1.19.4 vulnerability fixes
cert-manager v1.19.4 is a patch release addressing reported vulnerabilities, including CVE-2026-24051 and CVE-2025-68121.
securityhighThe otel SDK dependency update
The otel SDK dependency is bumped in cert-manager v1.19.4 to address GO-2026-4394.

Source ↗

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.

Source ↗

Keycloak26.5.4SecurityFeb 20, 2026

ACTION 2CHECK 4OTHER 10View full analysis

A maintenance release with five disclosed security fixes, one new capability, and ten corrected bugs. It contains no operator prerequisites or dependency-manifest entries.

Action needed (2)

securitymediumCVE-2026-0707, authorization header parsing
This release corrects authorization header parsing that could bypass security controls.
securitylowCVE-2025-5416, keycloak-core environment information disclosure
This release fixes environment information disclosure in keycloak-core.

Check if affected (4)

securitymediumCVE-2026-2575, excessive SAMLRequest decompression
Applies if you use SAML.
securitylowCVE-2026-1190, SAML brokering response delay
Applies if you use SAML brokering.
securitylowCVE-2026-2733, disabled client check for Docker Registry Protocol
Applies if you use the Docker Registry Protocol.
+ 1 more on the release page

Source ↗

Kyvernov1.17.1SecurityFeb 19, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release includes a security fix for CVE-2025-68121, along with defect corrections and dependency updates. It also changes operator-facing defaults and configuration documentation, including a default that now uses a duration string.

Action needed (1)

securitycriticalCVE-2025-68121 security fix
CVE-2025-68121 is fixed in this release.

Check if affected (1)

breakingDefault value and Helm values documentation format change
Applicability is not stated in the release notes.

Source ↗

Kubescapev4.0.2SecurityFeb 18, 2026

OTHER 2View full analysis

This release corrects runtime version reporting in the release build configuration and upgrades the go-git dependency. No individual changes are listed for display.

Source ↗

Open Policy Agent (OPA)v1.13.2SecurityFeb 18, 2026

ACTION 1View full analysis

OPA v1.13.2 updates the Go version used to build its binaries and images. The release includes the Go standard library fix for GO-2026-4337.

Action needed (1)

securitycriticalGo 1.25.7 build dependency
OPA binaries and images are now built with Go 1.25.7. The Go standard library in that version contains a fix for GO-2026-4337.

Source ↗

Kubescapev4.0.1SecurityFeb 12, 2026

OTHER 1View full analysis

Kubescape v4.0.1 is a maintenance release focused on operator-facing correctness. The remaining release material covers headings, test changes, and merge metadata rather than additional user-facing changes.

Source ↗

OpenFGAv1.11.5SecurityFeb 11, 2026

ACTION 1OTHER 1View full analysis

This release includes an operator-facing toolchain update. The change addresses CVE-2025-68121 in OpenFGA v1.11.5.

Action needed (1)

securitycriticalThe Go toolchain, updated to 1.25.7
The Go toolchain is updated to 1.25.7 in OpenFGA v1.11.5 to address CVE-2025-68121.

Source ↗

OpenFGAv1.11.4SecurityFeb 10, 2026

ACTION 1OTHER 1View full analysis

OpenFGA v1.11.4 fixes a planner regression in specific scenarios and updates the OpenTelemetry SDK. The SDK change addresses a disclosed issue affecting earlier versions.

Action needed (1)

securityThe otel/sdk dependency at v1.40.0
The otel/sdk dependency is upgraded to v1.40.0 in OpenFGA v1.11.4 to address the issue identified as SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758 in earlier versions.

Source ↗

Keycloak26.5.3SecurityFeb 10, 2026

ACTION 4OTHER 3View full analysis

A maintenance release focused on security fixes, with additional ordinary bug corrections. It also includes startup-memory corrections and a removal related to that area.

Action needed (4)

securityhighCVE-2026-1609, disabled users obtaining tokens through the JWT Authorization Grant
Keycloak 26.5.3 fixes an issue where disabled users could still obtain tokens through the JWT Authorization Grant.
securityhighCVE-2026-1529, forged invitation JWT enabling cross-organization self-registration
Keycloak 26.5.3 fixes an issue where a forged invitation JWT could enable self-registration across organizations.
securityhighCVE-2026-1486, authentication through disabled identity providers
Keycloak 26.5.3 fixes a logic bypass in the JWT Authorization Grant that allowed authentication through disabled identity providers.
securitymediumCVE-2025-14778, incorrect ownership checks in /uma-policy/
Keycloak 26.5.3 fixes incorrect ownership checks in the /uma-policy/ endpoint.

Source ↗

Kubescapev4.0.0SecurityFeb 4, 2026

ACTION 1OTHER 7View full analysis

Kubescape v4.0.0 expands operator capabilities while changing sensing architecture and scan output behavior. It also updates a dependency, improves scan performance, and includes a fix for version handling and injection.

Action needed (1)

securityVersion handling and injection fix
The release fixes version handling and injection in Kubescape v4.0.0.

Source ↗

cert-managerv1.18.5SecurityFeb 2, 2026

ACTION 1OTHER 3View full analysis

cert-manager v1.18.5 contains a security fix for GHSA-gx3x-vq4p-mhhv alongside other bug fixes. It also adds IPv6 HTTP-01 support and updates the Go toolchain.

Action needed (1)

securitymediumGHSA-gx3x-vq4p-mhhv denial-of-service fix
cert-manager v1.18.5 fixes the denial-of-service issue identified by GHSA-gx3x-vq4p-mhhv. The release contains three bug fixes in total.

Source ↗

cert-managerv1.19.3SecurityFeb 2, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.

Check if affected (1)

securitymediumcert-manager controller DNS response panic fix, GHSA-gx3x-vq4p-mhhv
Applicability is not stated in the release notes.

Source ↗

Kyvernov1.17.0SecurityFeb 2, 2026

ACTION 2CHECK 2OTHER 142View full analysis

A substantial feature and maintenance release adds CEL and policy capabilities while correcting controller and API defects. It also includes security fixes, including a kubectl image update for CVEs, along with dependency and integration changes.

Action needed (2)

securitySecurity vulnerabilities addressed
Security vulnerabilities are addressed in this release.
securityUpdated kubectl image for CVE fixes
The kubectl image is updated to address CVEs in this release.

Check if affected (2)

breakingRestricted resource access in namespaced CEL policy types
Applies if you use namespaced CEL policy types.
breakingOpt-in VAP/MAP reporting
Applies if you use VAP/MAP reporting.

Source ↗

Open Policy Agent (OPA)v1.13.1SecurityJan 29, 2026

OTHER 1View full analysis

OPA v1.13.1 is a defect-fix release. It addresses a correctness issue in array.flatten when processing single-item arrays.

Source ↗

Open Policy Agent (OPA)v1.13.0SecurityJan 29, 2026

OTHER 37View full analysis

OPA v1.13.0 adds a Decision Logger upload mode and a Rego built-in while broadening built-in input support. It also includes runtime and compiler fixes, performance work, and dependency updates; no security advisories or vulnerabilities are disclosed.

Source ↗

OpenFGAv1.11.3SecurityJan 28, 2026

ACTION 2OTHER 9View full analysis

This release adds configuration and observability capabilities while changing throttling and metric behavior. It also fixes correctness defects, including a described improper policy enforcement issue.

Action needed (2)

securitymediumThe CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9 policy enforcement fix
The release fixes improper policy enforcement associated with CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9.
breakingThe custom grpc_code metric label, removed
The custom grpc_prometheus fork is replaced with go-grpc-middleware's provider, and the custom grpc_code label is removed from the metric.

Source ↗

Falco0.43.0SecurityJan 28, 2026

CHECK 2PLAN 4OTHER 16View full analysis

A maintenance release that removes source-config-path output from release builds, deprecates several userspace interfaces, and rotates the package-signing key. It also includes correctness fixes, dependency updates, and an image-size reduction.

Check if affected (2)

breakingSource config path output in release builds
Applies if you use debug builds.
breakingGPG signing key for DEB/RPM packages, rotated
Applies if you use DEB/RPM packages.

Plan ahead (4)

deprecatedThe --gvisor-generate-config CLI option, deprecated
Applies if you use --gvisor-generate-config.
deprecatedThe legacy eBPF probe, deprecated
Applies if you use the legacy eBPF probe.
deprecatedThe gVisor engine, deprecated
Applies if you use the gVisor engine.
+ 1 more on the release page

Source ↗

Kyvernov1.15.3SecurityJan 27, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with security-related fixes for the Go toolchain and cross-namespace access through apiCall. It also contains ordinary defect fixes and capability or behavior changes.

Action needed (1)

securityThe go version update for standard library CVEs
The go version is updated to fix standard library CVEs in this release.

Check if affected (1)

securityCross-namespace access through apiCall prevented
Applies if you use apiCall.

Source ↗

Kyvernov1.16.3SecurityJan 27, 2026

OTHER 3View full analysis

Kyverno v1.16.3 includes changes to operator-facing policy behavior, including namespace selector overrides, context size limits, and cross-namespace access handling. The provided release data contains no individual change entries to display.

Source ↗

Keycloak26.5.2SecurityJan 23, 2026

ACTION 3OTHER 14View full analysis

Keycloak 26.5.2 is a maintenance release with security fixes alongside ordinary bug fixes and enhancements. The security updates affect third-party dependencies and Keycloak's token issuance logic.

Action needed (3)

securitymediumCVE-2025-67735 in netty-codec-http
CVE-2025-67735 addresses request smuggling via CRLF injection in netty-codec-http. The fix ships in Keycloak 26.5.2.
securitymediumCVE-2025-66560 in io.quarkus/quarkus-rest
CVE-2025-66560 addresses the Quarkus REST worker thread exhaustion vulnerability in io.quarkus/quarkus-rest. The fix ships in Keycloak 26.5.2.
securitymediumCVE-2025-14559 in keycloak-services
CVE-2025-14559 addresses a business logic flaw in keycloak-services that allowed unauthorized token issuance for disabled users. The fix ships in Keycloak 26.5.2.

Source ↗

Confidential Containersv0.18.0SecurityJan 23, 2026

CHECK 2PLAN 2OTHER 17View full analysis

A release that removes or deprecates several operator-facing components while adding capabilities and changing supported formats and behavior. It also updates shipped platform components, including Trustee, image-rs, guest kernels, and OVMF.

Check if affected (2)

breakingProcess-based confidential computing via enclave-cc, removed
Applies if you use enclave-cc.
breakingExperimental Secure Comms mode, removed from the Cloud API Adaptor
Applies if you configure Secure Comms mode.

Plan ahead (2)

breakingThe CoCo operator, deprecated, with Helm chart installation
Applies if you use the CoCo operator.
deprecatedpacker guest images, deprecated in favor of mkosiremoval date not announced
Applies if you use packer images.

Source ↗

Kubescapev3.0.48SecurityJan 22, 2026

OTHER 10View full analysis

Kubescape v3.0.48 is a maintenance release with metrics and reporting additions, workload-scan and panic fixes, and dependency updates. The release concerns users of the affected metrics, reporting, scanning, configuration, and signing components.

Source ↗

Cloud Custodian0.9.49.0SecurityJan 16, 2026

OTHER 27View full analysis

Cloud Custodian 0.9.49.0 adds AWS and Azure resource support and expands policy filtering. It also changes behavior for several AWS resources, updates dependencies, and changes how c7n-left handles HCL errors. No security advisories or security-specific fixes are disclosed.

Source ↗

SPIREv1.14.1SecurityJan 15, 2026

OTHER 4View full analysis

SPIRE v1.14.1 is an operator-facing maintenance release with fixes and behavior adjustments across server startup, key management, identity caching, and metrics. The changes affect Windows deployments, users of the aws_kms KeyManager plugin, JWT-SVID cache behavior, and consumers of the uptime_in_ms gauge metric.

Source ↗

Open Policy Agent (OPA)v1.12.3SecurityJan 14, 2026

OTHER 2View full analysis

This release contains correctness fixes for configuration values during reconfiguration. It addresses misinterpreted discovery polling intervals and an incorrectly assigned decision log buffer size.

Source ↗

Keycloak26.5.1SecurityJan 14, 2026

CHECK 1OTHER 13View full analysis

Keycloak 26.5.1 is a maintenance release with a security fix in the Organization feature. It also contains correctness fixes, a performance improvement, and changes to HTTP responses and realm administration.

Check if affected (1)

securityThe Organization feature account-name exposure fix
Applies if you use the Organization feature.

Source ↗

Kyvernov1.16.2SecurityJan 9, 2026

OTHER 5View full analysis

Kyverno v1.16.2 contains compatibility, metric-output, performance, and cleanup-controller changes. The release also includes cherry-pick pointers and release-management metadata.

Source ↗

← NewerMar 19, 2026 – Jan 9, 2026Older →

Browse by month