RATATOSKRATATOSK
Sign in

Cilium

v1.18.14Networking & Messaging
Sep 16, 2026

ACTION 3OTHER 33

A maintenance release focused on bug fixes, dependency updates, and image refreshes. It also removes a datapath behavior and includes security dependency fixes that may require operator attention.

Action needed (3)

  • securityThe google.golang.org/grpc module, updated to v1.83.1

    The google.golang.org/grpc module is updated to v1.83.1 in this release as a security dependency fix.

  • securityThe google.golang.org/grpc module, updated to v1.83.2

    The google.golang.org/grpc module is updated to v1.83.2 in this release as a security dependency fix.

  • breakingThe Ingress HostFW Policy between RevSNAT and RevDNAT, removed

    The Ingress HostFW Policy between RevSNAT and RevDNAT is removed in this release.

All 33 other recorded changesvalue changes 17 · fixes 14 · additions 2

value changes (17)

  • update all external docker images dependencies to v0.13.6
  • update all-dependencies (v1.18)
  • update base-images to v1.26.8
  • update dependency go to v1.25.14
  • update dependency protocolbuffers/protobuf to v36
  • update dependency protocolbuffers/protobuf to v36.1
  • update docker.io/library/golang docker tag to v1.25.14
  • update docker.io/library/ubuntu:24.04 docker digest to 224a186
  • update gcr.io/distroless/static:nonroot docker digest to e2e927e
  • update quay.io/cilium/certgen docker tag to v0.4.11
  • update quay.io/cilium/cilium-envoy docker tag to …×3
  • Update node-cache image version to 1.26.5
  • cilium: revert have_set_retval fix and probe it differently, v2
  • proxy: Bump envoy to v1.37.x
  • install: Update image digests for v1.18.13

fixes (14)

  • Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes.
  • Fix agent crash when dumping map events
  • fix IPV4_DIRECT_ROUTING selection on lo device
  • Fix Hubble Relay remains running during termination
  • Fix missing config setup for 'enable-non-default-deny-policies' flag
  • Fix nodeport egress tuple reuse for closed connections
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes
  • fix(socketlb): only detach Cilium-owned cgroup programs
  • Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change
  • Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max.
  • hubble: fix four config knobs that never reach their sink
  • operator: Emit startup logs in the configured log format
  • Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values
  • Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing

additions (2)

  • Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes
  • helm: add general busybox image values for substitution
Add Cilium to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Cilium releases →