Skip to content

v2026.9.1 — unpublished security candidate

Candidate build date: 2026-09-01

The signed v2026.9.1 tag completed the release workflow, staged the expected 16-asset draft, and pushed signed controller-image and OCI-chart tags. During the required pre-publication review, the release-image scan reported two versioned dependency findings for which fixes were available:

  • CRITICAL CVE-2026-56854 in golang.org/x/crypto v0.52.0, fixed in v0.55.0.
  • HIGH CVE-2026-46600 in golang.org/x/net v0.55.0, fixed in v0.56.0.

Symbol-aware govulncheck found no reachable vulnerable call path in the controller: the reported SSH path is server-only while CVK uses SSH client APIs, and the reported DNS message symbols are not called. Even so, maintainers made a no-go decision because a release with fixed HIGH/CRITICAL dependency findings should not be published.

The immutable tag and draft are retained as release-history evidence and will not be moved, deleted, or published. No release: published event occurred, so no documentation deployment or Krew update was triggered for v2026.9.1. Do not use its image, chart, draft assets, download URLs, or installation selectors.

The older workflow emitted the mutable 2026.9 and latest image aliases before its advisory scan, so those aliases can temporarily resolve to this unpublished candidate during recovery. Do not advertise or use them, and do not rerun the v2026.9.1 tag workflow: a rerun could move the aliases again outside the corrected release gates. The v2026.9.2 workflow replaces them only after both image platforms and the complete staged candidate pass.

The remediated September release is v2026.9.2. Its product delta remains measured from the last official release, v2026.8.1.