# Kubescape v4.0.17

> Security · 2026-10-28

A feature-rich maintenance release adds MCP, scanning, reporting, and output capabilities while improving correctness, deterministic behavior, input validation, and performance. Operators should note that `accountID` now requires a UUID in `config set` and `config validate`.

## Action needed
- **[breaking]** UUID requirement for `accountID`
  - `accountID` now requires a UUID in `config set` and `config validate`.

## Check if affected
- **[security]** Spreadsheet formula injection protection in summary CSV output
  - Applies when generating summary CSV output.
  - Summary CSV output now neutralizes spreadsheet formula injection.
- **[security]** Spreadsheet formula injection protection in CSV output
  - Applies when generating CSV output.
  - CSV output now neutralizes spreadsheet formula injection.
- **[security]** URI credential exposure suppression for variable references
  - Applies when URI parts are variable references.
  - The MCP server now suppresses URI credential exposure when URI parts are variable references.
- **[security]** Spreadsheet formula injection protection in CSV report output
  - Applies when generating CSV report output.
  - CSV report output now neutralizes spreadsheet formula injection.
- **[security]** Spreadsheet formula injection protection in CSV output
  - Applies when generating CSV output.
  - CSV output now neutralizes spreadsheet formula injection.

## Other recorded changes
- 151 (defect_corrected 113, added 26, value_changed 6, constraint_changed 4, removed 1, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/kubescape/v4.0.17)

[Original release notes](https://github.com/kubescape/kubescape/releases/tag/v4.0.17)