AI-analyzed release notes for CNCF graduated and incubating projects.
Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.
Action needed (1)
securityhighThe quinn-proto security fix
The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.
Check if affected (1)
breakingDefault wasip3 enablement with wasmtime 46
Applies if your workloads use wasip3.
Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.
Action needed (1)
securityGo 1. update
Go is updated to 1. in v1.14.0 for CVE remediation.
Flux v2.9.0 removes two deprecated API versions and adds CLI and controller capabilities across several Flux resources. It also changes supported Kubernetes versions, corrects defects, and updates project and third-party dependencies.
Check if affected (1)
breakingRemoval of deprecated Flux API versions
Applies if your CRDs use the image. or notification. APIs.
This release removes an orphan CRD, adds operator-facing capabilities and output changes, and corrects runtime, validation, reporting, and scan-processing defects. No security advisories or explicitly exploitable vulnerabilities are disclosed.
Check if affected (1)
breakingSecurityException CRD removal
Applies if you use the SecurityException CRD.
This release updates the Alpine base image and fixes a Helm chart TLS certificate issue. The Helm fix applies to deployments that use a custom namespace, while the base image change addresses security concerns.
Action needed (1)
securityThe alpine base image, upgraded
The alpine base image is promoted from alpine:3. to alpine:3. to address security concerns.
Karmada v1.17.4 updates its Alpine base image to address security concerns. The release also fixes a Helm chart TLS certificate SAN mismatch when deploying to a custom namespace.
Action needed (1)
securityThe alpine base image, updated to alpine:3.
The alpine base image is updated from alpine:3. to alpine:3. to address security concerns. The update ships in Karmada v1.17.4.
Karmada v1.16.7 updates its Alpine base image for security concerns and includes a Helm chart fix for TLS certificate SANs in custom namespaces. The release affects deployments that use the updated image or the affected Helm chart configuration.
Action needed (1)
securityThe alpine base image, updated
The base image alpine is promoted from alpine:3. to alpine:3. to address security concerns.
A maintenance release with a security fix for unbounded reads in the Terraform remote configuration loader and a correctness fix for CUE imports in status details. It also adds repository ownership metadata.
Check if affected (1)
securityUnbounded read prevention in the Terraform remote configuration loader
Applies if you use the Terraform remote configuration loader.
This release includes a security correction for an unbounded-read denial-of-service condition in the Terraform remote configuration loader. The fix is backported to release-1. and concerns deployments that use this loader.
Check if affected (1)
securityTerraform remote configuration loader DoS fix (GHSA-fmgp-q6jx-gg3x)
Applies if you use the Terraform remote configuration loader.
Adds experimental BatchCheck support for weighted_graph_check and changes in_cidr matching for IPv4-mapped IPv6 addresses. The remaining changes are diagnostic or storage-internal and require no operator action.
A maintenance release with a dependency and toolchain update, broad defect corrections, and behavior improvements across authentication, routing, monitoring, clustering, and JetStream. It also removes JSONP monitoring callbacks and addresses MQTT and authorization-related connection and permission handling.
Check if affected (3)
securityNats-Trace-Dest publish permission checks for leaf connections
Applies if you use Leaf connections.
securityMQTT subscribe deny rules on retained message and QoS replay paths
Applies if you use MQTT.
breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.
A maintenance release with dependency updates, operational behavior changes, and correctness fixes across General, MQTT, Monitoring, and JetStream. It also removes JSONP callback support from monitoring endpoints.
Check if affected (1)
breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.
A maintenance release corrects a memory leak introduced in OPA v1.17.0, involving AnnotationSet and a runtime. cycle.
This release adds operator-facing configuration and feature capabilities while updating supported Apache Kafka versions and related integrations. It also changes TLS file handling for KafkaBridge and KafkaMirrorMaker2 and renames entity-operator healthcheck ports, so those areas may require attention.
Check if affected (3)
breakingSupport for Kafka 4. removed
Applies if you use Kafka 4..
breakingPEM-based TLS files for KafkaBridge and KafkaMirrorMaker2
Applies if you use KafkaBridge or KafkaMirrorMaker2 with TLS authentication or a TLS truststore.
breakingEntity-operator healthcheck port names
Applies if you use entity-operator healthcheck ports.
Volcano v1.14.3 is a bug-fix release for operator-relevant scheduling, resource accounting, pod metadata, status handling, and scheduler snapshots. The recorded release data contains no individual change entries to display.
Source ↗Version 26.6.4 is a security-focused Keycloak release with fixes for disclosed vulnerabilities. It also upgrades Quarkus to 3., an informational dependency change for operators.
Action needed (8)
securityhighCVE-2026-9099, group-admin escalation to realm-admin
Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.
securityhighCVE-2026-9086, cross-site scripting via URI validation bypass
Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.
securityhighCVE-2026-9795, improper scope mapping enforcement
Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.
securityhighCVE-2026-9800, policy enforcer URI comparison
Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.
securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass
Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.
securitymediumCVE-2026-9083, arbitrary filesystem path probing
Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.
securitymediumCVE-2026-9705, disabled client takeover
Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.
securitymediumCVE-2026-9799, UMA permission ticket bypass
Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.
This release primarily updates dependencies and base images, including the Ansible operator plugin version. No security advisories or explicitly described vulnerabilities are included.
Source ↗Backstage v1.52.1 is a maintenance release focused on operator-facing defect fixes. It addresses scheduler task state during trigger changes and a broken configuration schema in the Kubernetes React plugin.
Source ↗A maintenance release with a correctness fix, a configuration and behavior adjustment, and updates to dependencies and the toolchain. No security advisory or operator action is disclosed.
Source ↗A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.
Check if affected (1)
breakingThe User-Agent header format
Applies if you configure server-side log filters or WAF rules that exact-match the old string.
OpenCost v1.120.4 is a maintenance release with operator-facing fixes and updates to configuration, tooling, provider integrations, and runtime behavior. No security advisories or explicit security vulnerabilities are disclosed.
Source ↗cert-manager v1. changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.
Action needed (2)
securityhighGo v1. with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1. in cert-manager v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1. dependency upgrade
Go is upgraded to 1. as part of the dependency updates in cert-manager v1..
Check if affected (1)
securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.
A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.
Action needed (1)
securityhighGo updated to v1.
Go is updated to v1. to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
Check if affected (1)
securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.
A maintenance release with bug fixes, behavior changes, and two operator-visible default changes. It also updates a runtime dependency and tightens validation and payload handling; no security vulnerability or advisory is explicitly identified.
Check if affected (2)
breakingThe in_monitor_agent visibility default
Applies if in_monitor_agent runs.
breakingThe in_debug_agent local-machine default
Applies if in_debug_agent runs.
A maintenance release updates project dependencies, including Kubernetes components, cluster-api, and Go. It also corrects the IPA cache address.
Source ↗v2.5.0 adds operator-facing capabilities and changes download and proxy behavior. Deprecated API surface is removed and correctness issues are fixed; no security advisory is disclosed.
Action needed (1)
breakingHealth checks consolidated to /healthy
Health checks are consolidated to the /healthy endpoint in v2.5.0.
Check if affected (1)
breakingDeprecated V1 preheat API endpoints removed
Applies if you use the deprecated V1 preheat API endpoints.
Dragonfly v2.4.4 contains scheduler defect fixes and dependency version updates. The release does not identify a security advisory or an explicitly exploitable vulnerability.
Source ↗A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.
Action needed (7)
securityhighCVE-2026-48044, Zstd decompressor ratio enforcement
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.
securitymediumCVE-2026-47692, PROXY protocol TLV length validation
CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.
securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling
CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.
securitymediumCVE-2026-48090, asynchronous token callback lifetime
CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.
securitymediumCVE-2026-47778, peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.
securitymediumCVE-2026-48497, query name length checking
CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.
securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix
GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.
Check if affected (7)
securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation
Applies if you enable envoy..
securityhighCVE-2026-48042, JSON parser nesting depth limit
Applies if you set envoy. to false.
securitymediumCVE-2026-47207, ext_proc server response handling
Applies if you use the ext_proc server.
A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.
Action needed (4)
securitymediumCVE-2026-47221 in HTTP 303 internal redirects
CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.
securitymediumCVE-2026-48090 in asynchronous token change callbacks
CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.
securitymediumCVE-2026-47778 in peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.
securitymediumCVE-2026-48497 query name length checking
CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.
Check if affected (11)
securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter
Applies if you configure the %REQUESTED_SERVER_NAME% formatter.
securityhighCVE-2026-48044 in the Zstd decompressor
Applies if you use the Zstd decompressor.
securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation
Applies if you use HTTP/3 and enable envoy..
A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.
Action needed (12)
securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy..
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.
Check if affected (5)
securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
A bug-fix release with two security fixes, along with routine correctness fixes and Go toolchain dependency updates. The security changes affect users of the static grpc auth plugin or twopcz handler; the release also updates Go to go1. and go1..
Check if affected (2)
securityConstant-time password comparison in the static grpc auth plugin
Applies if you use the static grpc auth plugin.
securityEscaping of reflected form values in the twopcz handler
Applies if you use the twopcz handler.
Vitess v23.0.5 is a maintenance release with numerous bug corrections across core components, along with Go dependency updates. It also includes changes to authentication timing and reflected form escaping.
Source ↗A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.
Action needed (16)
securityhighThe com_github_wasmtime dependency update
The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.
securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220
The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb, CVE-2026-48044
The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042
The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securitymediumAuthz per route crash, CVE-2026-47205
The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.
securitymediumThe ext_proc response issue, CVE-2026-47207
The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.
securitymediumRouter internal redirects crash, CVE-2026-47221
The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.
securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775
The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.
securitymediumThe grpc_stats filter segfault, CVE-2026-47204
The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.
securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692
The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.
securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778
The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.
securitymediumOAuth2 filter late token completion, CVE-2026-48090
The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.
securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497
The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.
securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706
The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.
securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch
The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.
Check if affected (2)
breakingThe envoy. extension removal
Applies if you use envoy..
breakingThe envoy. default
Applies if you do not configure envoy..
A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy. contrib extension at the Bazel layer for all builds and platforms.
Action needed (1)
securityhighcom_github_wasmtime dependency update, CVE-2026-47261
The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.
Check if affected (16)
securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220
Applies if you configure REQUESTED_SERVER_NAME.
securityhighzstd RLE zip bomb fix, CVE-2026-48044
Applies if you depend on zstd.
securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042
Applies if you use JSON.
A maintenance release fixes the release pipeline by adding automated draft release support. It contains no other operator-facing product changes.
Source ↗A maintenance release updates k8s. from 0. to 0.. The remaining release material does not describe a distinct operator-facing change.
Tekton v1.3.6 contains dependency update batches, with no functional or security changes described. The release material also includes installation instructions and attestation or verification metadata.
Source ↗Nothing here needs operator attention. The release notes contain installation, attestation, and verification instructions, along with empty section headings, but no described product changes.
Source ↗A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy. is disabled in all builds.
Action needed (1)
securityhighHighly nested JSON destructor stack overflow
The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
Check if affected (15)
securityhighzstd RLE zip bomb correction
Applies if you use zstd.
securityhighHTTP/3 to HTTP/1 request smuggling
Applies if you use HTTP/3 and HTTP/1.
securityhighcom_github_wasmtime dependency update
Applies if you use wasm.
A maintenance release with three dependency updates, including an update to k8s. from 0.33.12 to 0.33.13. Nothing else in the release requires operator attention.
