Vulnerabilities in Cluster Autoscaler

Security Scan Report

Our internal security scan reports the following vulnerability in the Cluster Autoscaler (CA) images.

Component	CVE	Suggested Remediation
Cluster Autoscaler	CVE-2026-25681	Upgrade golang.org/x/net/html to >= 0.55.0
Cluster Autoscaler	CVE-2026-42506	Upgrade golang.org/x/net/html to >= 0.55.0
Cluster Autoscaler	CVE-2026-25680	Upgrade golang.org/x/net/html to >= 0.55.0
Cluster Autoscaler	CVE-2026-42502	Upgrade golang.org/x/net/html to >= 0.55.0
Cluster Autoscaler	GO-2026-6061	Upgrade google.golang.org/grpc/internal/transport to >= 1.82.1
Cluster Autoscaler	CVE-2026-46600	Upgrade net to >= 1.26.6, 1.27.0-rc.3
Cluster Autoscaler	CVE-2026-84304	Upgrade google.golang.org/grpc to >= 1.83.1

Affected Images

Image
cluster-autoscaler:1.29.5
cluster-autoscaler:1.30.7
cluster-autoscaler:1.31.5
cluster-autoscaler:1.32.7
cluster-autoscaler:1.33.4
cluster-autoscaler:1.34.3
cluster-autoscaler:1.35.0

Questions

1. What criteria does the Cluster Autoscaler team use to determine whether a reported CVE is addressed in a patch release?
2. Is CVE-2026-25681 planned to be fixed in an upcoming patch release by upgrading golang.org/x/net/html to >= 0.55.0?
3. Since this CVE affects multiple maintained CA releases, is there a plan to backport the fix to all supported release branches?

Thanks!