This release adds attestors, plugins, configuration options, and CLI/API capabilities. It also updates dependencies and includes behavior changes and defect fixes, with no security advisories or explicitly described vulnerabilities.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: SPIREClear ×
A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.
Action needed (2)
securityMigration from
github.tocom/docker/docker github.com/moby/moby Dependencies from
github.were migrated to theircom/docker/docker github.equivalents to resolve CVEs. The migration ships in this release.com/moby/moby breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.
Check if affected (1)
breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.
The delegated API no longer serves JWT-SVIDs for admin or downstream entries. This behavior ships in the delegated API in this release.
SPIRE v1.15.1 includes a security correction for Azure IMDS node attestation. The release also updates the golang. and golang. dependencies.
Check if affected (1)
securityAzure IMDS node attestation validation
Applies if you use the
azure_imdsserver node attestor plugin.The
azure_imdsserver node attestor now validates the certificate used for the signature against the trusted Azure roots, preventing forged attested documents from being accepted during node attestation. The fix ships in SPIRE v1.15.1.
SPIRE v1.14.7 fixes a security vulnerability in Azure IMDS node attestation. It also updates the Go toolchain to 1.26.3 and updates three dependencies.
Check if affected (1)
securityThe
azure_imdsnode attestor validation is correctedApplies if you use the
azure_imdsserver node attestor plugin.SPIRE v1.14.7 corrects validation in the
azure_imdsserver node attestor plugin. The fix ensures the certificate used for signature verification matches the certificate validated against trusted Azure roots, preventing forged attested documents from being accepted.
SPIRE v1.15.0 adds operator capabilities, changes CLI and output behavior, and updates dependencies. It also fixes correctness issues, with no security advisory or vulnerability disclosed.
Source ↗A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.
Check if affected (2)
securityThe
aws_iidattestation identity verificationApplies if you use the
aws_iidserver node attestor plugin.The
aws_iidserver node attestor plugin no longer returns an identity document from an attacker-controlled field after verifying theRSA-2048 PKCS7signature. The fix prevents a compromised EC2 instance from impersonating another instance during node attestation.securityJoin token data store deletion
Applicability is not stated in the release notes.
The join token data store now uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. This fixes a TOCTOU issue where concurrent attestations using the same token could both succeed because
tx.did not report when no row was deleted.Delete()
This is a security and correctness fix release for SPIRE node attestation. It addresses forged EC2 identity handling in aws_iid and concurrent join-token attestation behavior.
Check if affected (1)
securityCorrected
aws_iidEC2 identity verificationApplies if you use the
aws_iidserver node attestor plugin.The
aws_iidserver node attestor plugin now verifies the RSA-2048 PKCS7 attestation identity document from the signed content instead of a separate attacker-controlled field. This fix ships in SPIRE v1.13.6.
This release updates the Go dependency and toolchain to address multiple disclosed CVEs. It concerns deployments that rely on the release's bundled Go version.
Action needed (1)
securitycriticalThe
Gotoolchain, updated to1.26. 2 The release updates the
Gotoolchain to1.to address CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281.26. 2
This release updates the Go dependency to address multiple disclosed CVEs. It concerns deployments that receive their Go runtime or builds from this release.
Action needed (1)
securitycriticalThe
Godependency, upgraded to1.25. 9 The release upgrades
Goto1.to address CVE-2026-32282, CVE-2026-32289, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, CVE-2026-27140, and CVE-2026-32281. The update ships in this release.25. 9
This release fixes an agent version-reporting defect during re-attestation or SVID renewal. The recorded release note describes the agent's startup version being replaced by an empty string during that process.
Source ↗A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.
Action needed (1)
securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.
Check if affected (1)
securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.
TLS session tickets are disabled on the server side, so
VerifyPeerCertificateruns on every connection and TLS session ticket resumption cannot bypass SPIFFE certificate chain validation against the current trust bundle.
Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.
Check if affected (2)
securityThe
http_challengeserver node attestor plugin, SSRF issue fixedApplies if you use
http_challenge.The
http_challengeserver node attestor plugin no longer permits an attacker to redirectspire-serverto an unauthorized domain, make an unauthenticated GET request, and receive the first 64 bytes of the response.securityThe
x509popserver node attestor plugin, CPU-exhaustion issue fixedApplies if you use
x509pop.The
x509popserver node attestor plugin no longer allows an attacker to makespire-serverconsume disproportionate CPU time during node attestation.
A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.
Check if affected (2)
securityThe
http_challengeserver node attestor plugin, SSRF issue correctedApplies if you use the
http_challengeserver node attestor plugin.The fix addresses an SSRF issue that could redirect
spire-serverto an inaccessible domain, make an unauthenticated GET request, and return the first 64 bytes of the response to the attacker.securityThe
x509popserver node attestor plugin, CPU consumption issue correctedApplies if you use the
x509popserver node attestor plugin.The fix addresses an issue that could cause
spire-serverto consume large and disproportionate amounts of CPU time during node attestation.
SPIRE v1.14.1 is an operator-facing maintenance release with fixes and behavior adjustments across server startup, key management, identity caching, and metrics. The changes affect Windows deployments, users of the aws_kms KeyManager plugin, JWT-SVID cache behavior, and consumers of the uptime_in_ms gauge metric.