Buoyant Enterprise for Linkerd

September 15, 2026

The 2.20.3 stable point release addresses three of the six vulnerabilities described in Buoyant Security Advisory 2026-01; the remaining three were fixed in enterprise-2.20.0. This release also updates some dependencies to address reported CVEs in underlying components.

Previous release: enterprise-2.20.2.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.31, and the maximum supported Kubernetes version remains 1.36.

Who should upgrade?

Users who are affected by Buoyant Security Advisory 2026-01 should upgrade.

Other users may upgrade to this release at their convenience to take advantage of the fixes and addressed CVEs.

Upgrade guidance

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.6 or later.

Changelog

• Fixed remote cluster credentials to disallow exec auth provider. GHSA-7hx9-xmmq-23f3
• Fixed HTTP host matching to be case-insensitive. GHSA-7cq8-3jwj-3pcf
• Aligned HTTPRoute matching with the Gateway API specification. GHSA-x393-w43f-gq32
• Fixed GRPCMethodMatch to allow service and method fields to be optional.
• Fixed errors in gRPC-web clients by emitting the exact size of unary bodies without trailers.
• Fixed core response errors to include path in structured logs.
• Update golang.org/x/crypto to remediate
  • GO-2026-6303
• Update github.com/containerd/containerd to remediate
  • GHSA-7jxh-36q5-gcqv
• Update google.golang.org/grpc to remediate
  • GHSA-vp52-pcj8-j9qc
  • GHSA-qc2q-p7wx-3px3
  • GHSA-2v4p-qf9q-27wj
• Update libcrypt1 to remediate
  • CVE-2026-18374
• Update linux-pam to remediate
  • CVE-2026-54411