Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×

Kubeflow26.03AI & MLMar 22, 2026

ACTION 1CHECK 1OTHER 18View full analysis

This release updates supported Kubernetes and pod-security configurations, installation behavior, and bundled component versions. The main operator-facing changes are the Kubernetes 1.34+ requirement and the baseline pod-security enforcement default, alongside fixes and new capabilities.

Action needed (1)

breakingBaseline pod security enforcement
Pod security enforcement changes to the baseline level in this release.

Check if affected (1)

breakingKubernetes 1.34+ requirement
Applies if you use Kubernetes 1.34+.

Backstagev1.49.1CI/CD & App DeliveryMar 20, 2026

CHECK 1OTHER 6View full analysis

This release contains API and template changes, new DevTools functionality, frontend behavior changes, and defect corrections. No security advisories or security-specific fixes are stated.

Check if affected (1)

breakingThe catalog entity page layout header is disabled
Applies if you use the catalog entity page in the new frontend system.

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Harborv2.15.0Storage & DataMar 20, 2026

ACTION 2CHECK 2OTHER 72View full analysis

A feature and compatibility release adds registry, cache, signing, profiling, and configuration capabilities. It changes proxy-cache behavior, removes GCR replication, and includes dependency, base-component, and defect corrections.

Action needed (2)

securityBearer token validation
Harbor rejects bearer tokens issued before project creation.
breakingPort 9443 removed from the webhook event check
Port 9443 is removed from the Harbor IP used for webhook event checks.

Check if affected (2)

breakingThe pull-through cache is replaced by proxy cache
Applies if you use pull-through cache in Harbor.
breakingGCR replication removal
Applies if you use GCR replication in Harbor.

SPIREv1.14.4SecurityMar 19, 2026

OTHER 2View full analysis

This release fixes an agent version-reporting defect during re-attestation or SVID renewal. The recorded release note describes the agent's startup version being replaced by an empty string during that process.

OpenFGAv1.12.1SecurityMar 19, 2026

OTHER 2View full analysis

A maintenance release updates grpc-go to v1.79.3 and grpc-health-probe to v0.4.47. It also corrects OTEL_EXPORTER_OTLP_ENDPOINT handling for URI schemes, including TLS activation for https:// endpoints.

Linkerdedge-26.3.3Networking & MessagingMar 19, 2026

OTHER 26View full analysis

Linkerd edge-26.3.3 fixes a proxy restart defect and updates dependencies and shipped component versions. No security issue or operator configuration change is disclosed.

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.

Operator Frameworkv1.42.2Orchestration & ManagementMar 19, 2026

OTHER 2View full analysis

A maintenance release updates the google.golang.org/grpc dependency from 1.78.0 to 1.79.3 and updates the Ansible operator plugin to 1.42.2. Generated-file maintenance and the section heading do not affect operators.

metal3-iov0.11.6Provisioning & RuntimeMar 19, 2026

OTHER 11View full analysis

This release contains bug fixes and dependency and toolchain updates. No security advisories or explicitly described vulnerabilities are identified.

metal3-iov0.12.3Provisioning & RuntimeMar 19, 2026

OTHER 9View full analysis

Metal3-io v0.12.3 fixes two controller defects and updates several dependencies and the Go toolchain. No security advisories or security-specific fixes are identified.

Keycloak26.5.6SecurityMar 19, 2026

CHECK 8OTHER 10View full analysis

A security and maintenance release that fixes disclosed vulnerabilities alongside ordinary bugs. The security fixes require upgrading, while the other fixes require no operator action beyond upgrading.

Check if affected (8)

securitymediumCVE-2026-1180, blind SSRF in OIDC Dynamic Client Registration
Applies if you use OIDC Dynamic Client Registration.
securitymediumCVE-2025-14777, Keycloak IDOR in realm client creation and deletion
Applicability is not stated in the release notes.
securitymediumCVE-2026-3121, privilege escalation via manage-clients permission
Applies if you configure manage-clients permission.
+ 5 more on the release page

Kubernetesv1.35.3Kubernetes CoreMar 19, 2026

OTHER 3View full analysis

A maintenance release with Kubeadm correctness fixes and an adjustment to DRA device taint eviction status behavior. It contains no identified security changes or operator actions.

Kubernetesv1.34.6Kubernetes CoreMar 19, 2026

OTHER 2View full analysis

A kubeadm maintenance patch corrects defects in cluster lifecycle handling. The changes affect etcd client endpoints and reset-time unmounting of /var/lib/kubelet peer mounts.

Kubernetesv1.33.10Kubernetes CoreMar 19, 2026

OTHER 3View full analysis

A maintenance release focused on operator-facing bug fixes in admission validation and cluster lifecycle workflows. No security advisories, operator-actionable removals, default changes, or new constraints are described.

Cloud Custodian0.9.50.0SecurityMar 18, 2026

OTHER 56View full analysis

Cloud Custodian 0.9.50.0 adds operator-facing resources, filters, actions, and configuration options across AWS, Azure, and GCP. It also corrects provider-specific defects and changes existing filtering and policy behavior, with no security advisories or explicit vulnerability fixes described.

SPIREv1.14.3SecurityMar 18, 2026

ACTION 1CHECK 1OTHER 9View full analysis

A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.

Action needed (1)

securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (1)

securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.

Litmus3.27.0ObservabilityMar 18, 2026

OTHER 12View full analysis

Version 3.27.0 adds support for targeting Jobs in chaos experiments and removes the 1024-character limit on CMD probe commands. It also corrects runtime, synchronization, UI, and backend defects. No security advisories or security-specific fixes are disclosed.

Backstagev1.49.0CI/CD & App DeliveryMar 17, 2026

CHECK 14PLAN 7OTHER 38View full analysis

A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.

Check if affected (14)

breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
breakingDeprecated types and options
Applies if you use deprecated types and options.
+ 11 more on the release page

Plan ahead (7)

deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
+ 4 more on the release page

Kubescapev4.0.3SecurityMar 17, 2026

OTHER 3View full analysis

A maintenance release with an updated OpenTelemetry SDK, a new --grype-db-url option for the Kubescape scan command, and a fix for missing-host handling. The remaining release-note entries are merge, heading, or internal logging changes.

Limav2.1.0Kubernetes CoreMar 17, 2026

CHECK 1OTHER 13View full analysis

A feature release that adds guest OS support, CLI capabilities, virtualization and synchronization features, template support, and a default hypervisor change for non-native architectures. The guest home directory moves from /home/${USER}.linux to /home/${USER}.guest with a compatibility symlink, and no security changes are disclosed.

Check if affected (1)

breakingQEMU as the default hypervisor for non-native architectures
Applies if QEMU runs on non-native architectures.

KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026

ACTION 1OTHER 7View full analysis

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

breakingThe QuiesceFailed indication replaced by QuiesceTimeout
The QuiesceFailed indication was replaced with QuiesceTimeout.

KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

ACTION 1CHECK 2OTHER 16View full analysis

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

securityhighCVE-2025-47913 remediation
The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

breakingQuiesceFailed indication renamed to QuiesceTimeout
Applies if you use Windows VSS.
breakingDefaultVirtWebhookClient{QPS,Burst} values aligned
Applicability is not stated in the release notes.

Fluxv2.8.3CI/CD & App DeliveryMar 16, 2026

OTHER 2View full analysis

Flux v2.8.3 fixes a helm-controller templating regression. The release also identifies helm-controller v1.5.3.

Argov3.3.4CI/CD & App DeliveryMar 16, 2026

OTHER 3View full analysis

Argo CD v3.3.4 includes signed container images, a fix that skips token refresh threshold parsing in unrelated components, and an otel-sdk dependency update. The release also contains CI-only work, headings, and installation examples without separately actionable operator impact.

KServev0.17.0AI & MLMar 13, 2026

ACTION 13CHECK 6OTHER 91View full analysis

An operator release with expanded configuration and LLMInferenceService capabilities, plus chart and dependency updates, behavior changes, removals, and defect corrections. It also includes security fixes for operators to review.

Action needed (13)

securitycriticalh11 malformed-body fix for CVE-2025-43859
h11 malformed-body handling associated with CVE-2025-43859 is addressed in this release.
securityhighstarlette version 0.49.1
starlette is pinned to version 0.49.1 to fix CVE-2025-62727 in this release.
securityhighlightgbm version 4.6.0
lightgbm is updated to version 4.6.0 for CVE-2024-43598 in this release.
securityhighCVE-2025-66418 decompression-chain fix
The unbounded number of links in the decompression chain associated with CVE-2025-66418 is addressed in this release.
securityhighexpr-lang/expr version v1.17.7
expr-lang/expr is updated to v1.17.7 to fix CVE-2025-68156 in this release.
securityhighcryptography fix for CVE-2026-26007
The cryptography issue associated with CVE-2026-26007 is addressed in this release.
securityhighpython-multipart fix for CVE-2026-24486
The arbitrary file write issue in python-multipart associated with CVE-2026-24486 is addressed in this release.
securitymediumFixes for CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181
This release addresses CVE-2025-22872, CVE-2025-47914, and CVE-2025-58181.
securityhttps.go path traversal prevention
The path traversal issue in https.go is prevented in this release.
securitySeveral CVE fixes
This release addresses several CVEs.
securityAIOHTTP HTTP Parser auto_decompress fix
The AIOHTTP HTTP Parser auto_decompress feature issue involving zip bombs is addressed in this release.
securityextractTarFiles path traversal fix
The path traversal vulnerability in extractTarFiles is addressed in this release.
breakingminio replacement with seaweedfs
minio is replaced with seaweedfs in this release.

Check if affected (6)

breakinginferenceservice CRD cert-manager annotation removal
Applies if you use the inferenceservice CRD.
breakingPython 3.9 support removal
Applies if you run Python 3.9.
breakingDeprecated --disable-log-requests flag removal
Applies if you configure --disable-log-requests.
+ 3 more on the release page

Buildpacksv0.40.2CI/CD & App DeliveryMar 13, 2026

OTHER 3View full analysis

A maintenance release updates builders to include lifecycle v0.21.0 and fixes lifecycle binary selection for amd64. It also adds ubi9, ubi10, and noble as suggested builders.

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.

Longhornv1.11.1Storage & DataMar 13, 2026

OTHER 21View full analysis

Longhorn v1.11.1 is a maintenance release with operator-relevant correctness fixes, CSI and V2 engine improvements, and compatibility changes. No security advisories or explicitly security-related flaws are disclosed.

Strimzi0.45.2Networking & MessagingMar 12, 2026

ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

securityhighGRPC Netty Shaded update for CVE-2025-55163
GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.
securitymediumZookeeper update for CVE-2024-47554
The Zookeeper dependency was upgraded to remediate CVE-2024-47554.
securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864
Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.
securitymediumNetty 4.1.130.Final update for CVE-2025-67735
Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.
securitymediumApache Log4J 2.25.3 update for CVE-2025-68161
Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.
securitymediumVertx 4.5.24 update for CVE-2026-1002
Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.
securitymediumJackson update for GHSA-72hv-8253-57qq
Jackson was updated to address GHSA-72hv-8253-57qq.
securityVert.x and Netty dependency updates
The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

breakingKubernetes support narrowed to 1.25 and newer
Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46
Applies if you use the Strimzi MirrorMaker 2 Extensions.
breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46
Applies if you use the Strimzi EnvVar Configuration Provider.
deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46
Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Fluxv2.8.2CI/CD & App DeliveryMar 12, 2026

ACTION 1OTHER 7View full analysis

Flux v2.8.2 includes correctness fixes and dependency updates. It also fixes a disclosed TLS-handshake denial-of-service issue in the controller builds.

Action needed (1)

securitymediumCVE-2026-27138 TLS-handshake DoS fix
The TLS-handshake denial-of-service issue identified as CVE-2026-27138 is fixed by building all controllers with Go 1.26.1.

Linkerdedge-26.3.2Networking & MessagingMar 12, 2026

CHECK 1OTHER 25View full analysis

This release narrows Linkerd Viz scraping behavior and adds the inbound_http_request_duration_seconds and inbound_grpc_request_duration_seconds metrics histograms. It also updates dependencies and ships proxy v2.342.0.

Check if affected (1)

breakingLinkerd Viz default scraping configuration
Applies if you use Linkerd Viz.

Helmv3.20.1Kubernetes CoreMar 12, 2026

OTHER 3View full analysis

A maintenance release with fixes for chart value handling and OCI reference parsing, plus a Kubernetes dependency-group update.

Helmv4.1.3Kubernetes CoreMar 11, 2026

ACTION 1OTHER 13View full analysis

Helm v4.1.3 is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.

Action needed (1)

securityhighThe go.opentelemetry.io/otel/sdk dependency update for GO-2026-4394
The go.opentelemetry.io/otel/sdk dependency was updated to v1.40.0 for GO-2026-4394 in Helm v4.1.3.

Dragonflyv2.4.3Storage & DataMar 11, 2026

OTHER 6View full analysis

Dragonfly v2.4.3 is a dependency maintenance release with updates to five third-party dependencies and d7y.io/api. No security advisory or operator-facing behavior change is described.

Backstagev1.48.5CI/CD & App DeliveryMar 11, 2026

ACTION 1View full analysis

A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Action needed (1)

securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

KubeEdgev1.23.0Provisioning & RuntimeMar 11, 2026

CHECK 1OTHER 8View full analysis

This release expands Windows and device-management support while changing edge database and node-query behavior. It also updates Kubernetes and changes how consumers retrieve device status through the DeviceStatus CRD.

Check if affected (1)

breakingDevice status moved to the DeviceStatus CRD
Applies if you use the Device CRD.

Envoyv1.37.1Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.

← NewerMar 22, 2026 – Mar 11, 2026Older →

Browse by month