Cilium
v1.18.16Networking & MessagingOct 23, 2026
A security-focused maintenance release updates the Go toolchain and dependencies, corrects namespace-scoping behavior, and refreshes release artifacts. It does not introduce broad new operator features.
Action needed (1)
securityCVE-2026-111943 and the
GotoolchainThis release upgrades
Goto1.to address CVE-2026-111943. Compromised eMudhra intermediate CA certificates are no longer trusted.26. 10
All 6 other recorded changesvalue changes 4 · fixes 2
value changes (4)
- updates all dependencies to their latest patch versions.
- * chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.18) (cilium/cilium#49441, @cilium-renovate[bot])
- * chore(deps): update stable lvh-images (v1.18) (patch) (cilium/cilium#49531, @cilium-renovate[bot])
- * install: Update image digests for v1.18.15 (cilium/cilium#49388, @cilium-release-bot[bot])
fixes (2)
- * CiliumEnvoyConfig now only redirects Services in its own namespace, as documented;
- service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again.
Add Cilium to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.