Confluent for Kubernetes (CFK) patch release 3.1.2 addresses security hygiene improvements across CFK components through upgrades to third-party dependencies.
Security Vulnerabilities
This CFK release version did not include any upgrades related to exploitable security vulnerabilities.
Resolved hygiene issues in 3rd party dependencies
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifier to assist customers with analysis. This patch release version depends upon the following base OS image versions:
CVE |
CVSS |
Impacted Package Version |
Upgraded Package Version |
| CVE-2025-68121 | 10 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2025-61726 | 7.5 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2025-61729 | 7.5 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2026-21441 | 7.5 |
urllib3 < 2.6.0 | urllib3 = 2.6.3 |
| CVE-2025-61727 | 6.5 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2025-61728 | 6.5 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2025-58181 | 5.3 |
golang.org/x/crypto < 0.36.0 | golang.org/x/crypto = 0.46.0 |
| CVE-2025-61730 | 5.3 |
stdlib < v1.24.9 | stdlib = 1.25.7 |
| CVE-2026-25934 | 4.3 |
github.com/go-git/go-git/v5 < v5.13.0 | github.com/go-git/go-git/v5 = 5.16.5 |
This patch release version depends upon Red Hat Universal Base Image 9 Micro version 9.7-1773894938 for confluent-operator & confluent-init-container images.