v53.2.5

Kubeshark release v53.2.5 (05-01-2026)

Release Highlights

Kubeshark 53.2.5 adds native MySQL and PostgreSQL protocol dissection — both enabled out of the box — fixes server-side TLS decryption for pre-fork servers like PostgreSQL, and introduces a configurable dashboard entries limit. The release also includes stream-history playback, a 4× heap memory reduction in the dashboard, and several reliability fixes across the stack.

New Features

• MySQL protocol dissector — Full wire-protocol dissection for MySQL traffic on port 3306, enabled by default. Includes worker dissector, hub dependency update, front-end UI support, and e2e tests
• PostgreSQL protocol dissector — Full wire-protocol dissection for PostgreSQL traffic on port 5432, enabled by default. Includes worker dissector, hub dependency update, front-end UI support, and e2e tests
• Stream history — New API and UI for streaming historical (raw capture) traffic, enabling retrospective browsing of previously captured data with a time-picker range control
• Dashboard entries limit — New tap.dashboard.entriesLimit Helm value (default 300000) controls the maximum number of entries the dashboard holds in memory

Improvements

• Columnar entry storage — 4× heap memory reduction — Replaces sparse per-entry maps with dictionary-backed columnar storage, dramatically reducing browser memory usage
• Decode multi-message gRPC payloads — Request and response views now decode concatenated gRPC frames instead of showing raw bytes
• Surface grpc_method / grpc_status as KFL queries in UI — Clicking the Path row on gRPC entries emits grpc_method == "..." and clicking Grpc-Status emits grpc_status == N
• Show both entry namespaces by default — Source and destination namespaces are now always visible in the entry list
• Copy button for snapshot failure reason — Adds a clipboard copy button to snapshot error messages for easier debugging
• Document gRPC KFL fields in MCP schema — grpc, grpc_method, grpc_status are now documented in the MCP KFL schema
• Adjust KFL input boxes — Visual refinements to KFL filter input areas
• Release pipeline overhaul — Split the monolithic release-pr Makefile target into three independent, idempotent targets (release-siblings, release-pr-kubeshark, release-pr-helm) that can be rerun individually without side effects
• Fix Chart.yaml sync to kubeshark.github.io — The helm PR target was switching back to master before copying the chart, shipping the pre-bump version

Bug Fixes

• Fix server-side TLS decryption for pre-fork servers (PostgreSQL) — Adds dual-key connection_context and accept-symbol fallback for servers that fork before accepting connections
• Fix TLS stop-capturing — Prevent closing uprobe hooks for TLS workloads that are still being traced
• Fix Istio one-leg HTTP — Corrects single-leg HTTP capture in Istio service mesh environments
• Fix HTTP api-server one-leg — Resolves single-leg API server traffic capture
• Remove sliding-window TLS heuristic from all L7 dissectors — Eliminates false-positive TLS detection that could misclassify plaintext traffic
• Fix request/response matcher in MongoDB and Kafka — Corrects pairing logic in the MongoDB and Kafka protocol dissectors
• Fix Pebble use-after-close — Resolves a crash from accessing Pebble DB after it has been closed (worker#1114)
• Fix re-running dissection on failure — Snapshot dissection can now be retried after a failure without manual intervention
• Skip incomplete dissections from cloud upload — Prevents partially dissected snapshots from being uploaded to cloud storage
• Ensure auth credentials on all API requests — Mirrors auth headers to cookies for consistent authentication across all request types

Infrastructure & Dependencies

• Revert time-boundaries display above snapshots table — Reverted pending a redesign
• Update Go to 1.26.2
• Update build environment to latest version
• Bump deps to close Scout CVEs — Updates moby v2, go-jose, jsonparser, and OpenTelemetry dependencies)
• Update spdystream — Addresses CVEs
• Bump KFL2 and lock in gRPC trailer merge
• Drop arm64 race builds due to toolchain limitations
• Update registry offsets — Refreshes embedded Go TLS offset bundle
• Reduce noisy parse-packet log messages
• Update gRPC in e2e tests to address Dependabot issues
• Update hub dependencies for Docker Scout compliance

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v53.2.6 (05-01-2026)

• Add timestamp to the Dashboard's API call detailed information (right pane)
• Disable history range button when viewing delayed dissection

v53.2.7 (05-07-2026)

• SSO refactoring
• Fix rough toast messages on invalid license events
• Extract error status codes from Kafka responses
• Add PCAP boundary for preventing truncated packets
• Fix slice bounds out of range in HTTP dissection
• Fix sentry errors

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.5/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.5/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.5/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.5/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.2.5/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v53.2.3

Kubeshark release v53.2.3 (04-20-2026)

Release Highlights

Kubeshark 53.2.3 expands eBPF Go TLS decryption enabling transparent TLS visibility in proxies like Traefik that layer their own Conn types over the native TCP connection. The release also threads elapsed_time through every dissected API entry end-to-end, surfaces a dedicated tls KFL keyword, and ships reliability fixes around worker reconnection, reused-IP resolution, and snapshot time boundaries.

New Features

• Add eBPF Go TLS decryption, enabling TLS decryption in Traefik and similar wrapping proxies
• Add tls KFL keyword for filtering TLS-bearing traffic with a single boolean
• Add time boundaries display above the snapshots table to show the available data window at a glance

Improvements

• Populate elapsed_time in every BaseEntry end-to-end (worker → hub → dashboard), enabling latency filtering and sorting across all protocols
• Rename snapshots in cloud storage (S3/GCS/Azure) when the local snapshot is renamed
• Use file modification time for snapshot start boundary instead of creation time — fixes incorrect windows on filesystems that don't preserve birth time
• Set explicit nginx proxy_buffer_size / proxy_buffers directives to prevent upstream header-too-large errors under load
• Bump Go base image from 1.26.1 to 1.26.2

Bug Fixes

• Fix worker reconnection after container restart — the hub now correctly re-establishes worker streams, eliminating silent gaps in traffic
• Fix reused-IP resolution returning stale pod/service names after pod churn
• Fix BPF pids_info lookup by keying on cgroup_id instead of PID; add pid=0 wildcard fallback
• Fix BPF wrapper-chain unwrap to break only on concrete types (is_interface==0) and increase the chain limit from 2 to 4

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v53.2.4 (04-23-2026)

Stream history — New API for streaming historical (raw capture) traffic to the front-end, enabling retrospective browsing of previously captured data

• Columnar entry storage — 4x heap memory reduction — Replaces sparse per-entry maps with dictionary-backed columnar storage, dramatically reducing browser memory usage
• Stream history — Adds a history range picker UI that lets users browse raw capture traffic retrospectively with time-picker controls
• Surface grpc_method / grpc_status as KFL queries in UI — Clicking the Path row on gRPC entries emits grpc_method == "..." and clicking Grpc-Status emits grpc_status == N
• Show both entry namespaces by default — Source and destination namespaces are now always visible in the entry list
• Copy button for snapshot failure reason — Adds a clipboard copy button to snapshot error messages for easier debugging
• Fix request/response matcher in MongoDB and Kafka — Corrects pairing logic in the MongoDB and Kafka protocol dissectors
• Fix Pebble use-after-close — Resolves a crash from accessing Pebble DB after it has been closed
• Reduce noisy parse-packet log messages
• Update Go to 1.26.2
• Bump deps to close Scout CVEs — Updates moby v2, go-jose, jsonparser, and OpenTelemetry dependencies
• Update spdystream — Addresses CVEs
• Update registry offsets — Refreshes embedded Go TLS offset bundle
• Drop arm64 race builds — Removes arm64 race-detector builds due to toolchain limitations
• Add bifrost-1.4.23 — Extracted via the go-stripped strategy

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.3/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.3/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.3/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.3/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.2.3/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v53.2.2

Kubeshark release v53.2.2 (04-14-2026)

Release Highlights

Kubeshark 53.2.2 introduces MongoDB protocol dissection, bringing L7 visibility to MongoDB traffic across the dashboard, MCP tools, and KFL filtering. Kubernetes metadata enrichment has been moved from the hub to the worker nodes, significantly reducing hub load and improving scalability in large clusters. The eBPF tracer now supports Envoy BoringSSL TLS decryption via offset-based hooking and introduces a ring buffer-based packet poller for improved capture performance.

New Features

• Add MongoDB protocol dissector with request parsing (Phase 1), MCP transform support, and dashboard UI
• Add Envoy BoringSSL TLS decryption via offset-based hooking in the eBPF tracer
• Add dashboard-level namespace, worker, and dissector filters for granular traffic scoping
• Add back-end resolved entry summary display in the dashboard
• Add time preset buttons in snapshot creation dialog for quick time window selection
• Add external volume support for dissection jobs, enabling persistent storage across restarts
• Add recvmsg/sendmsg/recvmmsg/sendmmsg/readv/writev syscall hooks for improved SSL-to-fd tracking

Improvements

• Move Kubernetes metadata enrichment from hub to worker nodes — reduces hub load and improves scalability
• Stream pod Modified events to workers when enrichment fields change, keeping worker-side K8s metadata up to date
• Replace eBPF perf buffer with ring buffer-based packet poller for improved capture performance and memory efficiency
• Add async pin cleanup for graceful eBPF tracer termination, improving shutdown reliability
• Update MCP KFL schema to match KFL2 capabilities
• Update Network RCA AI skill resolution tools to list_workloads/list_ips
• Improve JSON payload detection and formatting in the dashboard
• Reset API stream on targeting change for consistent real-time view
• Extract snapshot tar archives directly during download for dissection
• Pass dissection storage flags to dissection jobs
• TCP flows in CLOSED state now bypass backend capture rules
• Add subPathExpr to worker DaemonSet for shared persistent storage
• Refactor string splitting in loops for improved performance
• Bump Go base image from 1.25.7 to 1.26.1

Bug Fixes

• Fix pod targeting collision for same-named pods in different namespaces
• Fix KFL K8s field filtering for MCP live queries
• Fix eBPF-TLS capture source icon in the dashboard
• Fix snapshot creation to use only healthy workers
• Fix do_accept() compatibility issue in eBPF tracer
• Fix processing of stop raw capture command
• Fix flaking tests in hub

Patches

When new patch releases are published, they will be automatically added and listed in this section.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.2.2/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v53.2.0

Kubeshark release v53.2.0 (03-31-2026)

Release Highlights

Kubeshark 53.2.0 introduces open-source AI skills for network root cause analysis and traffic filtering, making Kubeshark's MCP-powered workflows reusable and shareable. Snapshot capabilities have been significantly expanded with GCS cloud storage, local .tar upload, snapshot renaming, PCAP export filters, and disk usage visibility. TLS-decrypted traffic is now included in snapshots, and gRPC streaming has been rearchitected for improved reliability and real-time responsiveness. The eBPF tracer now supports stripped Go binaries via offset table lookups, improving TLS hooking reliability in production environments.

New Features

• Add KFL and Network RCA open-source AI skills for MCP-powered network analysis workflows
• Add GCS (Google Cloud Storage) support for snapshot cloud storage
• Add snapshot PCAP export filters dialog for targeted traffic extraction
• Add ability to rename snapshots
• Add ability to upload local .tar snapshot files for analysis
• Add snapshot creation from custom time windows with enhanced time selection and auto-dissection
• Add snapshot disk space usage and available space metrics in the Snapshots tab
• Add ability to recreate dissection by deleting old and creating new one
• Add get_api_call_details MCP tool with hub proxy routing
• Add snapshot support to list_api_calls and get_api_call_details MCP tools
• Add cloud storage MCP tools for upload/download operations
• Add Demo Portal readonly mode with no authentication required
• Add configurable L4 map visibility via Helm value
• Add IP/workload resolution database for snapshots, enabling workload-to-IP and IP-to-workload lookups
• Add BaseEntry history support for tracking entry changes over time
• Add KFL support for DNS resolution names (dst.dns)
• Add TLS (eBPF) indication in the UI with fixed KFL filtering
• Add explicit cloud storage configuration options
• Add Go offset table support for stripped binaries in eBPF tracer, with Build ID content hash matching and targetCgroup retry fallback

Improvements

• Include decrypted TLS traffic in snapshots via decrypted_pcap directory support
• Implement TCP segments coalescing to reflect real-time connection behaviour
• Rearchitect gRPC streaming with heartbeat/data event separation for improved reliability
• Send initial heartbeat ahead once gRPC client is ready to reduce UI load time
• Verify hub/front pods are ready by conditions before proceeding
• Use last modification time as snapshot data boundary end for accuracy
• Persist selected db query parameter across navigation
• Use more deterministic status indicators for loading L4/L7 entries
• Map legend: worker-node switching with no node legend item
• Use current time for new-snapshot end time by default
• Split TCP reader into two parts for delayed dissection; cancel request/response matcher goroutines in DD mode
• Skip applying KFL2 K8s expressions on worker side (hub-only)
• Exclude TCP-CONNs and UDP-CONNs from selected base entries fetch
• Skip capacity check for community edition within node/pod limits
• Download/export snapshots over direct HTTP for improved performance
• Use OIDC auth instead of interactive OAuth for MCP Registry publish
• Poll script logs when scripting is enabled
• Add ENTERPRISE2 license type support
• Delete worker from health report when not running
• Add BaseEntry ID and nodeID KFL2 filter expressions
• Add KFL2 filters for DNS resolution fields
• Add PCAP streaming bytes metric for monitoring

Bug Fixes

• Fix memory leak in flow tracer
• Fix DNS resolution for TLS entries in delayed dissection
• Fix TLS hooking in tracer (eBPF)
• Fix derived entries processing
• Fix dissection-control front environment variable logic
• Fix GraphQL entry view rendering
• Fix PCAP fetching for entries from dissection DB
• Fix snapshots local storage size calculation
• Fix snapshot data boundary detection using last modification time
• Fix handling of missing PCAPs in export and snapshot operations
• Fix dissection progress reporting and error handling
• Fix race condition between resolving DB query and stream start
• Fix L7 map for delayed-dissection entries when realtime dissection is stopped
• Fix streaming-cancelled error handling in the UI
• Fix entry details panel edge cases
• Fix entries-list z-index layering
• Restore cloud storage MCP tools accidentally dropped in prior PR
• Restore dissection telemetry on hub restart
• Use pending cgroups when container ID is not yet known (tracer)

Security

• Update compromised Trivy action across worker and hub CI pipelines
• Update tracer to fix gRPC vulnerability
• Upgrade trivy-action from 0.28.0 to 0.34.2
• Rename KubeHQ to Kubeshark, Inc. in LICENSE across all repos

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v53.2.1 (03-08-2026)

• MongoDB protocol dissector — request parsing (Phase 1)
• K8s enrichment moved from hub to worker
  • Populate K8s properties on worker instead of hub
  • Populate summary.name on PeerProperties with best available name
  • Improved resolution
• MongoDB support added to MCP transform
• K8s enrichment removed from startWorkerStream — moved to worker side
• Reset stream on targeting change — call update hook on targeting change
• Bump golang base image 1.25.7 → 1.26.1
• MongoDB dissector UI support
• Show back-end resolved entry summary
• Dashboard-level namespace/worker/dissector filters
• Improved JSON payload detection/formatting
• Reset stream on targeting change
• Fix ebpf-tls capture source icon
• Use healthy workers for creating a snapshot
• Update TS protobuf definitions
• Update api2

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.2.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.2.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v53.1.0

Kubeshark release v53.1.0 (03-05-2026)

Release Highlights

Kubeshark 53.1.0 introduces comprehensive L4 (TCP/UDP) network flow visibility with real-time connectivity tracking, handshake latency percentiles, and a new cluster-wide L4 map in the UI.

The release adds a built-in MCP (Model Context Protocol) server, enabling AI-powered network analysis through standardized tool integrations including snapshot management, L4/L7 querying, and PCAP export.

Snapshot workflows have been significantly enhanced with cloud storage support, delayed dissection capabilities, and streamlined download/upload operations.

Several critical CVEs have been patched, build security has been hardened following a responsibly-disclosed token exposure incident, and memory stability improvements have been made throughout the stack.

New Features

• Add MCP (Model Context Protocol) server for AI-powered network traffic analysis docs
• Add MCP tools for querying L4 flows, L7 API calls, snapshot management, and PCAP export L4 tools | L7 tools | raw capture tools
• Add MCP Registry support for official registry submission and discovery
• Add L4 (TCP/UDP) real-time network flow visibility with connection tracking docs
• Add cluster-wide L4 connectivity map in the dashboard docs
• Add P50/P90/P99 TCP handshake latency percentiles for network health monitoring docs
• Add snapshot cloud storage support (AWS S3 with cross-account IAM role assumption, Azure Blob) docs
• Add snapshot download and upload via HTTP REST endpoints
• Add delayed dissection mode for post-capture L7 protocol analysis docs
• Add automatic dissection trigger after snapshot completion docs
• Add KFL2 query language with GraphQL support for advanced traffic filtering docs
• Add L4 flow and connection entries in the UI with PCAP content loading docs
• Add DNS resolution name as fallback display in traffic entries
• Add --release-helmChartPath CLI flag for deploying with a local Helm chart
• Add captureSelf flag to enable or disable capturing Kubeshark's own traffic
• Add configurable cloud API URL

Improvements

• Rename flow terminology for consistency (flow for L4, conn for connections)
• Set default TCP and UDP flow timeouts to 20 minutes
• Adjust nginx configuration to support large snapshot uploads and downloads
• Improve L4 to L7 entry relationship tracking and consistency
• Apply DNS resolution as fallback when syscall-based resolution fails
• Optimize UI Docker builds and production bundle loading
• Improve license validation and UI stability for non-enterprise users
• Extend community license grace capacity on node and pod limit overflow
• Allow Pro plans to use license keys without requiring cloud login
• Exclude worker pods from scheduling on nodes that are not ready
• Improve dissection badge UX with updated text and color indicators
• Auto-align selected snapshot nodes with available ones in the UI
• Stop raw packet capture during snapshot download to ensure data consistency docs
• Batch mode processing for delayed dissection workloads docs
• Optimize memory usage in packet capture pipeline

Bug Fixes

• Fix memory leak in TCP handshake health aggregation
• Fix nil pointer dereferences in MCP L4 flow functions
• Fix crash when storing entries with TCP and UDP connection objects
• Fix L4 flows delayed dissection and PCAP generation
• Fix inter-node flow aggregation in the flows API
• Fix cleanup timings that could cause queries for already-deleted entries
• Fix peer resolution and resolution status population
• Fix frontend resolution display issues
• Fix node view rendering in the workload map
• Fix callback dependency for fetching selected entries in the UI
• Fix handling of empty payload and empty L4 metrics in delayed-dissection entries
• Fix data volume mount placement in Helm chart TLS configuration
• Fix MCP Hub API tool call field naming
• Fix ARM architecture build

Security

• Harden container build pipeline following a responsibly-disclosed GitHub token exposure in a container image — removed embedded tokens, switched to GitHub App tokens with minimal scopes, improved build isolation
• Fix CVE-2025-30204 by updating golang-jwt to patched versions
• Fix CVE-2025-47914 and CVE-2025-58181 by updating golang.org/x/crypto to 0.45.0
• Add backend license validation for cloud-connected deployments

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v53.1.2 (03-05-2026)

• Added MCP support for filters on PCAP downloads from a snapshot docs
• First version of cloud storage for snapshots with support for AWS and Azure
• Fixed Snapshot L4-CONN and L4-FLOW's PCAP download operation

v53.1.3 (03-09-2026)

• MCP improvements
• GCS cloud storage option for snapshots

v53.1.4 (03-11-2026)

• Fixed a bug that prevented downloading large PCAP files from snapshots (#1867)
• Temporarily disabled L4-connectivity-map because it breaks in large clusters (#1868)

v53.1.6 (03-18-2026)

• Add two-way workload-to-IP and IP-to-workload resolution in the form of an index DB as part of a snapshot, enabling workload names to be resolved to IPs and vice versa, and enabling slicing and dicing of snapshot PCAPs
• Added the ability to rename a snapshot
• Added KFL support for external domains (e.g. dst.dns=="google.com")
• Fixed various snapshot-related bugs
• Added an ability to create a snapshot from a time window

v53.1.7 (03-25-2026)

• Fixed an issue where decrypted TLS traffic was not included in snapshots.
• Resolved a vulnerability related to a compromised Trivy version.
• Fixed a memory leak in the Worker component.
• Fixed an issue where external workloads were not resolved due to missing DNS resolution in snapshots.
• Fixed an issue where the dashboard stopped displaying new items in the API stream due to a broken gRPC connection.
• Added disk usage and available space metrics for snapshots in the Snapshots tab.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.1.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.1.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.1.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v53.1.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v53.1.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v52.12.0

Kubeshark Release v52.12.0 (01-25-2026)

Release Highlights

This release includes minor features and bug fixes, along with foundational infrastructure for upcoming releases with more significant capabilities. This release also includes some domain changes (see below).

To install this version you might need to remove the previous Helm repository.

helm repo remove kubeshark
helm repo add kubeshark https://helm.kubeshark.com
‍helm install kubeshark kubeshark/kubeshark

Bug Fixes & New Features

• Improved performance of the cluster-wide L4 connectivity map.
• Fixed the missing footer bug in the frontend.
• Added individual PCAP files to snapshot archive downloads to help find the needle in the haystack in busy clusters.
• Transitioned the following domains:
  • docs.kubehq.com to docs.kubeshark.com
  • kubeshark.kubehq.com to demo.kubeshark.com
  • console.kubehq.com to console.kubeshark.com
  • helm.kubehq.com to helm.kubeshark.com
  • api.kubehq.com to api.kubeshark.com

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v52.12.1 (12-27-2025)

• Optimized raw-capture performance

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.12.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.12.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.12.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.12.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.12.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v52.11.7

Kubeshark Release v52.11.7 (01-14-2026)

Release Highlights

This release includes a complementary license, enabling Kubeshark to run in clusters of up to 100 nodes, free

Bug Fixes & New Features

• Extended complementary license

Patches

When new patch releases are published, they will be automatically added and listed in this section.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.7/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.7/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.7/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.7/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.11.7/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v52.11.0

Kubeshark Release v52.11.0 (12-16-2025)

Release Highlights

This is the first release in preparation for V2.00, which will be officially launched in January 2026. We will continue adding new features while deprecating older ones, as V1.00 is gradually being sunset.

You can read more about this transition here.

This release includes a complementary license, enabling Kubeshark to run in clusters of up to 100 nodes, free

Bug Fixes & New Features

• The backend was completely refactored. The new backend is now available as part of V2.00, while V1.00 continues to use the legacy backend. In addition to enabling new features, the new backend is significantly more performant than the legacy implementation.
• Added an easy way to export cluster-wide L4 traffic (PCAP). Read more here.
• Added L7-to-L4 mapping (API calls mapped to L4 TCP/UDP connections). This functionality includes an online PCAP viewer, as well as the ability to download a single aggregated PCAP file. Read more here
• Fixed an issue where backend filter rules related to namespace exclusion did not work correctly.

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v52.11.1 (12-26-2025)

• Bring back agentic infrastructure (not usable yet)
• Removed Connect Go buffering that caused message to appear missing as they were kept buffered under slow traffic conditions.
• Made cluster-wide L4 connectivity map default

v52.11.4 (12-31-2025)

• Fixed broken HTTP2 and WS dissectors
• Improved Dashboard memory consumption

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.11.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.11.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v52.10.3

Kubeshark release v52.10.3 (11-28-2025)

Release Highlights

Bug Fixes & New Features

• Added a complimentary, (almost) unlimited license valid through the end of 2025. The license is pre-included in the installation as a Helm value. Before installing, make sure to remove any previous Helm repository:

helm repo remove kubeshark
helm repo add kubeshark https://helm.kubehq.com

Patches

When new patch releases are published, they will be automatically added and listed in this section.

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.3/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.3/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.3/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.3/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.10.3/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.

v52.10.0

Kubeshark release v52.10.0 (11-25-2025)

Release Highlights

Bug Fixes & New Features

• Docs url change from https://docs.kubeshark.co/ to https://docs.kubehq.com
• Fixed #1766

Patches

When new patch releases are published, they will be automatically added and listed in this section.

v52.10.1 (11-26-2025)

• Fromt https://kubehq.com to https://www.kubehq.com

Download Kubeshark for your platform

Mac (x86-64/Intel)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.0/kubeshark_darwin_amd64 && chmod 755 kubeshark

Mac (AArch64/Apple M1 silicon)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.0/kubeshark_darwin_arm64 && chmod 755 kubeshark

Linux (x86-64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.0/kubeshark_linux_amd64 && chmod 755 kubeshark

Linux (AArch64)

curl -Lo kubeshark https://github.com/kubeshark/kubeshark/releases/download/v52.10.0/kubeshark_linux_arm64 && chmod 755 kubeshark

Windows (x86-64)

curl -LO https://github.com/kubeshark/kubeshark/releases/download/v52.10.0/kubeshark.exe

Checksums

SHA256 checksums available for compiled binaries.
Run shasum -a 256 -c kubeshark_OS_ARCH.sha256 to verify.