Source: byteiota
Kubernetes 1.34 hits end of life on 27 October 2026, and teams still running it should treat this week as their upgrade window. Once the deadline passes, the community stops triaging 1.34 issues entirely, which means no more CVE backports and no more bug fixes. Any vulnerability discovered in 1.34 code paths after that date becomes the operator’s problem to solve without upstream help.
The two CVEs that will not be backported again
The 23 September patch release, 1.34.12, fixed two vulnerabilities that matter even if neither is catastrophic in isolation. CVE-2026-19444 (CVSS 6.5) is a path traversal in kubectl cp affecting Windows clients. When copying files from a container, the Windows version of kubectl failed to translate forward slashes to backslashes, so an attacker who controls container contents could craft a tar archive that writes files to arbitrary paths on the admin machine, limited by local user permissions. Linux and macOS clients are not affected.
CVE-2026-2270 (CVSS 5.9) is a confused deputy issue in kube-controller-manager. Before the fix, the StatefulSet controller restored metadata, including namespace fields, from a ControllerRevision. An attacker with write access to both StatefulSets and ControllerRevisions in their namespace could plant a target namespace in that metadata and wait for the controller to recreate a pod in an unauthorised namespace, breaking the namespace isolation that multitenant clusters depend on. Neither vulnerability has confirmed exploitation in the wild, but the calculus changes completely once upstream stops patching the version you run.
Managed clusters have their own deadlines
The managed services add a financial argument. GKE standard support for 1.34 already ended on 1 October. EKS and AKS standard support ends on 2 December and 30 November respectively, and extended support costs around $0.60 per cluster-hour, roughly $438 per cluster per month. EKS adds an unwelcome detail: once the standard support window closes, it will automatically upgrade your control plane to the current stable version without notice if you have not done it yourself. That is the kind of surprise upgrade that disrupts workloads at the worst possible time. Kubernetes only supports upgrading one minor version at a time, so clusters several versions behind need a plan, not a panic. If your team wants help auditing cluster versions, staging a safe upgrade path or automating control plane upgrades so deadlines never surprise you again, contact Excello Digital at https://excello.digital/contact/. We run and modernise Kubernetes platforms for European businesses every day.