Vulnerability fixes

Upgrading a cluster to the latest Google Distributed Cloud version brings added features and fixes to your cluster. With each patch release, we fix numerous security vulnerabilities which makes upgrading to the latest recommended patch version all the more important. Upgrading is a shared responsibility between Google and the customer. For more information about shared responsibilities, see Shared Responsibility Model

This page is for Security specialists who support the resolution of security issues or vulnerabilities which need strategic assistance, such as incidents and issues escalated from support. To learn more about common roles and example tasks that we reference in Google Cloud content, see Common GKE user roles and tasks .

How vulnerabilities are classified

Security vulnerabilities are usually identified through the Common Vulnerabilities and Exposures (CVE) system. The GKE security team classifies vulnerabilities according to the Kubernetes vulnerability scoring system. Classifications consider many factors including GKE and Google Distributed Cloud configuration and security hardening. Because of these factors and the investments Google Cloud makes in security, these vulnerability classifications might differ from other classification sources.

The following table describes vulnerability severity categories:

Security bulletins

Most vulnerabilities are fixed in supported versions of Google Distributed Cloud before they can be exploited. When there are reported incidents that have the potential to compromise the security of your clusters and data, we publish security bulletins. A security bulletin describes the security issue and its impact and provides a mitigation. For more information and a list of published bulletins, see the Security bulletins page.

When a security bulletin is published for a vulnerability that affects Google Distributed Cloud (software only) on VMware, we publish a corresponding release note with a link to the bulletin.

Fixed vulnerabilities by Google Distributed Cloud patch version

The following table lists all vulnerabilities that have been fixed, starting in January 2025. For older fixes, see the release notes . The fixes in the following table are listed by Google Distributed Cloud release version and severity:

For more information about fixes and changes for a given release, see the release notes .