There is a comforting rhythm to vulnerability management.
A scanner finds a CVE. Someone opens a ticket. You upgrade a package. The scanner goes green again.
It is not glamorous work, but at least the shape of the problem is familiar.
Today, some Kubernetes teams are going to get a reminder that security does not always work like that.
The Kubernetes Security Response Committee is correcting the records for three older CVEs on June 1, 2026. The records previously suggested that fixed versions existed. They do not. These are architectural risks that remain present across Kubernetes versions, and scanners may start reporting them in clusters where they were not reported before.
