Security

The release images were rebuilt with Go 1.26.10, which includes the crypto/x509 mitigation for CVE-2026-111943 / GO-2026-6809. The refreshed Distroless trust bundle excludes emSign ECC Root CA - G3 and AAA Certificate Services, addressing the image rebuild request in #10621.

Changes by Kind

Bug or Regression

• Exclude GPU-labeled unmanaged nodes with unavailable GPU capacity from GPU quota usage, logging a warning instead of blocking cluster-wide scale-up. (#10407, @MaximilianoUribe)
• AWS: correctly extract placeholder instance names when an Auto Scaling Group name contains /. (#10352, @ketanjani21)
• AWS: fix integer overflow in memory calculations for ASGs using attribute-based InstanceRequirements without instance-type overrides. A MemoryMiB.Min of 2048 or greater could produce a zero-memory template node and prevent scale-up. (#10272, @pujitha24)
• Azure: fix VMSS instance deletion when disableAzureStackCloud is enabled. (#10086, @tallaxes)
• Cluster API: allow scale-down of MachinePool-backed node groups when no per-node Machine can be resolved, after verifying that the node belongs to the MachinePool, by decrementing the pool's replica count. (#10387, @mnaissiou)
• OCI: recover node pools when failed node creation leaves a node without an instance ID. (#10109, @jlamillan)
• OCI: treat instances from node pools outside the configured autoscaler scope as existing unmanaged instances instead of returning node-pool lookup errors. (#10335, @shreyshj)
• OCI: use registered nodes' actual ephemeral-storage capacity and allocatable values in existing node-pool templates, preserving configured template values if lookup fails. (#10513, @Debasish-87)

Other (Cleanup or Flake)

• Update Kubernetes dependencies to v1.36.6. (#10614, @jackfrancis)
• Change the default staging build/push destination to us-central1-docker.pkg.dev/k8s-staging-images/autoscaling. Production image URLs remain under registry.k8s.io/autoscaling. (#10601, @maxsxu)

Images

• registry.k8s.io/autoscaling/cluster-autoscaler:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-amd64:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-arm64:v1.36.2
• registry.k8s.io/autoscaling/cluster-autoscaler-s390x:v1.36.2

Full Changelog: cluster-autoscaler-1.36.1...cluster-autoscaler-1.36.2