RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

Project: KubeVirtClear ×
KubeVirtv1.9.0Orchestration & ManagementJul 30, 2026

A broad operator-facing release with fixes, behavior changes, new capabilities, API and feature-gate maturity changes, deprecations, and component updates. It also includes security updates for CVE-2026-35469, GHSA-pc3f-x583-g7j2, and CVE-2026-33186, along with a symlink-traversal fix and a security dependency update.

Action needed (2)

  • securitycriticalThe grpc dependency, updated

    grpc is updated to 1.79.3 to remediate CVE-2026-33186.

  • securityhighThe github.com/moby/spdystream dependency, updated

    The github.com/moby/spdystream dependency is updated from v0.5.0 to v0.5.1 to address CVE-2026-35469 (GHSA-pc3f-x583-g7j2).

Check if affected (9)

  • breakingStricter network interface binding admission

    Applies if you configure network interface bindings.

    Admission now rejects interfaces with no binding or multiple bindings instead of allowing them to fail silently at runtime.

  • breakingThe Template feature gate, enabled by default

    Applies if you enable the Template feature gate.

    The Template feature gate has graduated to Beta and is enabled by default. Virt-template components are deployed automatically unless explicitly disabled.

  • breakingThe ephemeral hotplug volume metric and alert, removed

    Applies if you use the ephemeral hotplug volume metric.

    The ephemeral hotplug volume metric and alert have been removed.

  • + 6 more on the release page

Plan ahead (2)

  • deprecatedcgroup v1 support, deprecatedremoval date not announced

    Applies if you run with cgroup v1 support.

    cgroup v1 support is deprecated, with removal planned for the next release.

  • deprecatedLegacy VM creation recording rules and metrics, deprecated

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

    Multiple recording rules are deprecated in favor of new names to comply with recording rule naming conventions. The kubevirt_vm_created_total recording rule and kubevirt_vm_created_by_pod_total metric are deprecated completely.

Source
KubeVirtv1.8.4Orchestration & ManagementJun 16, 2026

KubeVirt v1.8.4 adds observability coverage, changes node-labeller CPU feature handling, and fixes a virt-handler resource leak. It also updates a dependency to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Action needed (1)

  • securityhighThe github.com/moby/spdystream dependency, upgraded for CVE-2026-35469

    github.com/moby/spdystream is upgraded from v0.5.0 to v0.5.1 in KubeVirt v1.8.4 to address CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Source
KubeVirtv1.8.3Orchestration & ManagementJun 3, 2026

A maintenance release with a fix for symlink traversal, a gRPC dependency update addressing GHSA-p77j-4mvh-x3m3, and deprecated recording rules. It also contains correctness fixes across VM status reporting, device resource handling, live migration, alerts, and VM operations.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc update to 1.79.3

    The google.golang.org/grpc dependency is bumped to 1.79.3 to remediate GHSA-p77j-4mvh-x3m3.

  • securitySymlink traversal fix in the VMExport directory handler

    The VMExport directory handler is fixed to prevent symlink traversal.

Plan ahead (1)

  • deprecatedDeprecated kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total recording rules

    Applies if you use kubevirt_vm_created_total or kubevirt_vm_created_by_pod_total.

    The recording rules kubevirt_vm_created_total and kubevirt_vm_created_by_pod_total are deprecated in favor of new names to comply with recording-rule naming conventions. Both are deprecated completely.

Source
KubeVirtv1.7.4Orchestration & ManagementJun 3, 2026

KubeVirt v1.7.4 includes correctness fixes and behavior changes affecting PCI topology and IPv6 migration. It also updates the gRPC dependency to address CVE-2026-33186.

Action needed (1)

  • securitycriticalThe google.golang.org/grpc dependency update for CVE-2026-33186

    KubeVirt v1.7.4 updates google.golang.org/grpc to version 1.79.3 to remediate CVE-2026-33186.

Source
KubeVirtv1.6.6Orchestration & ManagementJun 3, 2026

KubeVirt v1.6.6 includes a dependency update for CVE-2026-33186. The recorded change affects the gRPC dependency shipped with this release.

Action needed (1)

  • securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186

    KubeVirt v1.6.6 bumps google.golang.org/grpc to remediate CVE-2026-33186.

Source
KubeVirtv1.7.3Orchestration & ManagementApr 24, 2026

KubeVirt v1.7.3 is an operator-focused maintenance release with defect corrections and behavior changes. The available assessment discloses no security advisories or security-specific fixes.

Source
KubeVirtv1.6.5Orchestration & ManagementApr 24, 2026

KubeVirt v1.6.5 contains bug fixes and behavior corrections across VM lifecycle, migration, storage, export, metrics, and virt-handler operation. The release has no disclosed security advisories or operator setup changes.

Source
KubeVirtv1.8.2Orchestration & ManagementApr 20, 2026

A correctness-focused release also changes backend volume naming and removes permissions from the kubevirt.io:edit RBAC role. The RBAC change requires operator attention.

Action needed (1)

  • breakingThe kubevirt.io:edit RBAC role, with vnc and screenshot permissions removed

    The vnc and screenshot permissions are removed from the kubevirt.io:edit RBAC role in this release.

Source
KubeVirtv1.8.1Orchestration & ManagementMar 30, 2026

KubeVirt v1.8.1 is a maintenance release focused on operator-facing defect fixes. The available release information points to fixes for virt-handler domain-notify server restarts and VMExport failures involving long PVC names.

Source
KubeVirtv1.8.0Orchestration & ManagementMar 24, 2026

A broad operator-facing feature and maintenance release with API and behavior changes, dependency updates, deprecations, and removals. Monitoring and configuration changes include recording-rule and feature-gate updates, alongside scheduling and security-related behavior changes; no security advisories are reported.

Check if affected (7)

  • breakingNetwork attachment definition get permissions in the virt-controller ClusterRole, removed

    Applicability is not stated in the release notes.

    Network attachment definition get permissions are removed from the virt-controller ClusterRole when conditioned by a feature gate.

  • breakingStop requests for paused VMIs, rejected

    Applies if you run paused VMIs.

    Stop requests for paused VMIs are rejected.

  • breakingThe EnableVirtioFsConfigVolumes feature, graduated to GA

    Applies if you use the EnableVirtioFsConfigVolumes feature gate.

    The EnableVirtioFsConfigVolumes feature has graduated to GA and no longer requires its associated feature gate to be enabled.

  • + 4 more on the release page

Plan ahead (4)

  • deprecatedThe DisableMDEVConfiguration feature gate, deprecatedremoval date not announced

    Applies if you use the DisableMDEVConfiguration feature gate.

    The DisableMDEVConfiguration feature gate is deprecated ahead of removal in a future release.

  • deprecatedThe kubevirt_vmi_migration_data_total_bytes metric, deprecated

    Applies if you use the kubevirt_vmi_migration_data_total_bytes metric.

    The kubevirt_vmi_migration_data_total_bytes metric is deprecated in favor of kubevirt_vmi_migration_data_bytes_total.

  • deprecatedThe MultiArchitecture feature gate, deprecated

    Applies if you use the MultiArchitecture feature gate.

    The MultiArchitecture feature gate is deprecated.

  • + 1 more on the release page
Source
KubeVirtv1.7.2Orchestration & ManagementMar 16, 2026

A maintenance release with operator-facing behavior fixes across backup handling, VMI updates, storage migration, and monitoring. It also updates the quiescing status indication used by KubeVirt.

Action needed (1)

  • breakingThe QuiesceFailed indication replaced by QuiesceTimeout

    The QuiesceFailed indication was replaced with QuiesceTimeout.

Source
KubeVirtv1.6.4Orchestration & ManagementMar 16, 2026

A maintenance release with a disclosed security fix, an indication rename for Windows VSS handling, and correctness, behavior, and observability updates. Most changes require no operator action beyond upgrading.

Action needed (1)

  • securityhighCVE-2025-47913 remediation

    The release adds a replace directive that points golang/x/crypto to the patched openshift/golang-crypto module to remediate CVE-2025-47913.

Check if affected (2)

  • breakingQuiesceFailed indication renamed to QuiesceTimeout

    Applies if you use Windows VSS.

    The release replaces the QuiesceFailed indication with QuiesceTimeout and adds a 60-second Velero pre-backup hook timeout to better handle Windows VSS limitations.

  • breakingDefaultVirtWebhookClient{QPS,Burst} values aligned

    Applicability is not stated in the release notes.

    The release aligns the DefaultVirtWebhookClient{QPS,Burst} values with DefaultVirtWebhookClient{QPS,Burst} to help avoid saturating the webhook client during mass eviction events.

Source
KubeVirtv1.7.1Orchestration & ManagementFeb 23, 2026

KubeVirt v1.7.1 is a maintenance release focused on correctness fixes, dependency updates, and expanded compatibility. It also adds a metric and alert for ephemeral hotplug volumes.

Source
Browse by month