K3s

Orchestration · products/k3s.yaml · RSS

Latest 1.37.1+k3s1 Sep 30, 2026

Recent releases

1.37.1+k3s1 Sep 30, 2026 Release notes ↗ 3fix

1.37.0+k3s1 Sep 14, 2026 → 1.37.1+k3s1 Release notes ↗ 6fix6feature1security

securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14614)

1.36.5+k3s1 Sep 30, 2026 → 1.37.1+k3s1 Release notes ↗ 1security3fix

securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14620)

1.36.4+k3s1 Aug 27, 2026 → 1.37.1+k3s1 Release notes ↗

1.36.3+k3s1 Aug 4, 2026 → 1.37.1+k3s1 Release notes ↗ 2feature2fix

1.36.2+k3s1 Jun 24, 2026 → 1.37.1+k3s1 Release notes ↗ 1fix

1.36.1+k3s1 May 20, 2026 → 1.37.1+k3s1 Release notes ↗

1.36.0+k3s1 May 6, 2026 → 1.37.1+k3s1 Release notes ↗ 2feature6fix

1.35.9+k3s1 Sep 30, 2026 → 1.37.1+k3s1 Release notes ↗ 1security3fix

securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14621)

1.35.8+k3s1 Aug 27, 2026 → 1.37.1+k3s1 Release notes ↗

1.35.7+k3s1 Aug 4, 2026 → 1.37.1+k3s1 Release notes ↗ 2fix1feature

1.35.6+k3s1 Jun 24, 2026 → 1.37.1+k3s1 Release notes ↗

1.35.5+k3s1 May 20, 2026 → 1.37.1+k3s1 Release notes ↗

1.35.4+k3s1 Apr 27, 2026 → 1.37.1+k3s1 Release notes ↗ 1fix

1.35.3+k3s1 Mar 28, 2026 → 1.37.1+k3s1 Release notes ↗

Security advisories

5.8 CVE-2026-54250 ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

7.5 CVE-2023-32187 K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

6.8 CVE-2021-32001 K3S bootstrap data is encrypted with empty string if user does not supply a token

Sources