Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×Project: etcdClear ×

etcdv3.6.9Kubernetes CoreMar 20, 2026

ACTION 4CHECK 1OTHER 7View full analysis

A security and maintenance release with authorization-bypass fixes and dependency updates that address reported vulnerabilities. It also includes correctness fixes, with no operator configuration changes or deprecations announced.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization bypasses in multiple APIs, CVE-2026-33413
The etcd server fixes authorization bypasses in multiple APIs. The issue is identified by CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgo.opentelemetry.io/otel/sdk updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0. The update addresses GO-2026-4394.
securityhighgolang.org/x/net updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (1)

securitylowRBAC checks for nested etcd transactions, CVE-2026-33343
Applies if you use nested etcd transactions and RBAC.
The etcd server fixes RBAC authorization checks for nested etcd transactions. The issue is identified by CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Source ↗

etcdv3.5.28Kubernetes CoreMar 20, 2026

ACTION 3CHECK 2OTHER 7View full analysis

A maintenance release with ordinary correctness fixes, disclosed security fixes, and security-related dependency updates. The security changes are addressed by upgrading, and no operator reconfiguration is explicitly required.

Action needed (3)

securitycriticalThe google.golang.org/grpc dependency, updated to 1.79.3
The release updates google.golang.org/grpc to 1.79.3 to resolve CVE-2026-33186.
securityhighThe go.opentelemetry.io/otel/sdk dependency, updated to v1.40.0
The release updates go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394.
securityhighThe golang.org/x/net dependency, updated to v0.51.0
The release updates golang.org/x/net to v0.51.0 to resolve GO-2026-4559.

Check if affected (2)

securityhighAuthorization bypasses in multiple APIs (CVE-2026-33413)
Applies if you use unauthenticated endpoints.
Authentication checks now guard unauthenticated endpoints in v3.5.28, addressing authorization bypasses in multiple APIs (CVE-2026-33413).
securitylowNested etcd transaction RBAC authorization checks (CVE-2026-33343)
Applies if you use nested txn ops.
Authentication checks now apply to nested etcd transactions in v3.5.28, addressing RBAC authorization bypasses (CVE-2026-33343).

Source ↗

etcdv3.4.42Kubernetes CoreMar 20, 2026

ACTION 4OTHER 3View full analysis

A maintenance release with authorization fixes for unauthenticated APIs and nested transactions. It also updates golang.org/x/net and google.golang.org/grpc to address reported issues.

Action needed (4)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3
The google.golang.org/grpc dependency is updated to 1.79.3 to resolve CVE-2026-33186.
securityhighAuthorization checks for unauthenticated endpoints
Unauthenticated endpoints in the etcd server now have authorization checks. This fixes authorization bypasses in multiple APIs, identified as CVE-2026-33413 and GHSA-q8m4-xhhv-38mg.
securityhighgolang.org/x/net updated to v0.51.0
The golang.org/x/net dependency is updated to v0.51.0 to resolve GO-2026-4559.
securitylowRBAC checks for nested etcd transactions
Nested transaction operations in the etcd server now enforce authorization checks. This fixes RBAC authorization bypasses in nested etcd transactions, identified as CVE-2026-33343 and GHSA-rfx7-8w68-q57q.

Source ↗

Browse by month