RATATOSKRATATOSK
Sign in

Cilium

v1.18.7Networking & Messaging
Feb 13, 2026

CHECK 1OTHER 27

Cilium v1.18.7 is a maintenance release with an operator-facing default change alongside bug fixes and dependency and image updates. It discloses no security advisories or security-specific fixes.

Check if affected (1)

  • breakingDefault exclusion of topology.kubernetes.io labels from security labels

    Applies if your workloads rely on topology.kubernetes.io labels being included in security labels.

    In v1.18.7, labels with the topology.kubernetes.io prefix are excluded from security labels by default.

All 27 other recorded changesvalue changes 15 · fixes 11 · additions 1

value changes (15)

  • chore(deps): update all-dependencies (v1.18)
  • chore(deps): update base-images (v1.18)×3
  • chore(deps): update docker.io/library/alpine docker tag to v3.22.3 (v1.18)
  • chore(deps): update docker.io/library/busybox:… docker digest to … (…)×2
  • chore(deps): update docker.io/library/ubuntu:24.04 docker digest to cd1dba6 (v1.18)
  • chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.18)
  • chore(deps): update quay.io/cilium/certgen docker tag to v0.3.2 (v1.18)
  • chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×4
  • install: Update image digests for v1.18.6

fixes (11)

  • Add permissions to the cilium-operator so that it can create EndpointSlices when the admission plugin OwnerReferencesPermissionEnforcement is activated
  • bpf: Correct refinement of inner packet L4 checksum detection
  • bpf: Fix marker to skip nodeport when punting to proxy
  • clustermesh: correctly phase out not ready/not service endpoints from global services
  • Fix a bug with local redirect service entries being created when backend pods weren't ready.
  • Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic.
  • Grant permissions to the cilium-operator so that it can reconcile ingresses when the when the admission plugin OwnerReferencesPermissionEnforcement is activated
  • helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals
  • loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B
  • Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations
  • multicast: fix nil assignment to node configuration cell.Out map

additions (1)

  • hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error)
Add Cilium to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Cilium releases →