RATATOSKRATATOSK
Sign in

Cilium

v1.20.4Networking & Messaging
Oct 23, 2026

ACTION 2OTHER 12

A security-focused maintenance release upgrades Go and dependencies and removes an unused vulnerable binary. It also adds RRSA credential support and includes correctness fixes across networking, IPAM, Gateway API, and related components.

Action needed (2)

  • securityCVE-2026-111943 and Go 1.26.10

    CVE-2026-111943 is addressed by upgrading Go to 1.26.10, so compromised eMudhra intermediate CA certificates are no longer trusted. All dependencies also receive their latest patch versions.

    golang/go#82345

  • securityThe pebble binary, removed

    The unused pebble binary was removed from the Cilium image to clear its Go standard library vulnerability findings.

All 12 other recorded changesfixes 10 · constraints 2

fixes (10)

  • fix outer ICMP checksum for ICMP/SCTP NAT error packets
  • CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again.
  • Fix NAT46x64 gateway prefix conversion panic
  • Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled.
  • Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12
  • Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic.
  • Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated.
  • in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event.
  • Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently
  • Fix Envoy xDS listener handling across restoration, address changes, and rejected updates

constraints (2)

  • support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator
  • Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured
Add Cilium to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Cilium releases →