# CRI-O v1.37.0

> Kubernetes Core · 2026-09-15

A substantial feature and compatibility release for operators, with changed defaults and interfaces alongside correctness and performance improvements. It also includes identified security fixes and refreshes a broad set of dependencies.

## Action needed
- **[security · high]** The `CVE-2026-15809` `/etc/passwd` injection fix
  - CRI-O fixes `CVE-2026-15809`, which allowed a bypass of the `CVE-2022-4318` fix and `/etc/passwd` injection through newline characters in the `HOME` environment variable.
- **[security · high]** The Go toolchain, updated to 1.26.4
  - The Go toolchain is updated to 1.26.4 to fix `CVE-2026-27145`, `CVE-2026-42504`, and `CVE-2026-42507`.

## Check if affected
- **[breaking]** The `insecure_registries` option and `--insecure-registry` flag, removed
  - Applies if you configure `insecure_registries` or use `--insecure-registry`.
  - The deprecated `insecure_registries` configuration option and `--insecure-registry` CLI flag are removed. Use the `insecure` option in `registries.conf` instead.
- **[breaking]** The `container_level_enabled` default, changed to `checkpoint_only`
  - Applies if you do not configure `container_level_enabled`.
  - The default for the `checkpoint_restore` configuration field `container_level_enabled` is now `checkpoint_only`, which disables restore by default.
- **[breaking]** The gRPC message size defaults, reduced to 16 MiB
  - Applies if `grpc_max_send_msg_size` or `grpc_max_recv_msg_size` is not configured.
  - CRI-O now defaults `grpc_max_send_msg_size` and `grpc_max_recv_msg_size` to 16 MiB, down from 80 MiB.
- **[breaking]** The `name` label on CRI metrics, removed
  - Applies if you use CRI metrics.
  - CRI-O removes the `name` label from CRI metrics.

## Other recorded changes
- 32 (defect_corrected 14, value_changed 7, added 6, constraint_changed 3, renamed 1, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/cri-o/v1.37.0)

[Original release notes](https://github.com/cri-o/cri-o/releases/tag/v1.37.0)