July 10th, 2026

Realtime Kubernetes

1.4.0 - Realtime Kubernetes

Added

  • Added support for Gateway API HTTPRoute and ListenerSet resources for the proxy service.

    • Gateway API support can be used as an alternative to Ingress and an Ingress controller.

    • Gateway resources are not created by this chart and must be managed separately.

Updates

  • Updated the Redis dependency to use 8.6.4-alpine image.

  • Updated the Realtime container and GPU Transcription Inference Container version to 15.14.0. For more information, see the 15.14.0 container release notes.

  • Updated the sessiongroups CustomResourceDefinitions and controller.

    • Refer to the sm-realtime Helm chart RELEASE_NOTES.md for upgrade details.

Deprecated

  • Deprecated the proxy.ingress.url Helm value in favour of proxy.ingress.hostname for configuring the Ingress hostname.

    • Existing deployments remain compatible: if proxy.ingress.hostname is not set, the chart will continue to use proxy.ingress.url as a fallback.

Security fixes

Vulnerability Management

  • Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.

  • OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.

Non-Applicable CVEs

The following vulnerabilities were reviewed and determined to have no security impact on this release due to specific configurations or the use of closed, trusted environments.

Container

Component

Identified CVEs

Reason

Transcriber (Realtime)

libgstreamer

CVE-2025-3887

Manually patched (build 1.24.2-sm-1320260); scanners may still flag it because the base version string remains unchanged

Transcriber (Realtime)

ffmpeg and bundled codec libraries (libopenexr, libmfx1, libde265, libzvbi, libopenh264, libopenjp2, libvo-amrwbenc, libsndfile, libsoup, libcurl, libp11-kit, glib-networking)

Multiple CVEs - see attached OpenVEX file for full per-CVE list

False positives: most stem from scanners matching against an older ffmpeg version tracker rather than the newer Speechmatics build (8.1.1) actually shipped; the rest are codec paths (video encode/decode, teletext, JPEG2000, etc.) never invoked by our audio-only decode-to-WAV pipeline

Transcriber (Realtime)

transformers

CVE-2026-4372, CVE-2026-1839

Model-loading / checkpoint-deserialization RCE path not invoked at runtime - the deployed code never calls from_pretrained / AutoModel

Transcriber (Realtime)

python3-pip (vendored urllib3/requests)

CVE-2024-35195, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-9375

Build/install-time only, not on any runtime path

GPU Inference Server (Transcription)

wheel, setuptools

CVE-2026-24049, CVE-2024-6345, CVE-2025-47273

Base-image packaging tooling not invoked at inference runtime; fixes available, to be picked up in a future rebuild

The control-plane components and bundled Redis image were also scanned (Medium severity and above) and no High or Critical vulnerabilities were identified.