RATATOSKRATATOSK
Sign in

Dapr

v1.18.10Orchestration & Management
Oct 31, 2026

ACTION 1CHECK 9OTHER 2

A security-focused maintenance release fixes access-control, isolation, denial-of-service, and crash issues. It also introduces breaking restrictions for public metadata writes and oversized gRPC metadata, which affect deployments using those paths or request patterns.

Action needed (1)

  • securitygRPC request-header size limit

    The gRPC API server and internal gRPC server now limit request headers to --read-buffer-size bytes, with a minimum of 64 KiB. The corresponding configuration is dapr.io/read-buffer-size.

Check if affected (9)

  • securityHTTP service invocation access-control matching

    Applies if you run HTTP apps.

    Service invocation access control for HTTP apps now matches policies against the routed method after decoding percent-encoded characters once and lowercasing it.

  • securityScheduler WatchJobs authorization for internal actor types

    Applies if a WatchJobs stream declares or sets a concurrency limit on an internal actor type, dapr.internal.*, that does not belong to the calling app and namespace.

    The Scheduler rejects a WatchJobs stream with PermissionDenied when it declares or sets a concurrency limit on an internal actor type, dapr.internal.*, that does not belong to the calling app and namespace.

  • securityDAPR_API_TOKEN protection for encoded health-check paths

    Applies if you configure DAPR_API_TOKEN.

    The API token middleware compares the same escaped path matched by the router, so a percent-encoded health-check path requires the API token.

  • securityInternal-port gRPC proxy target restriction

    Applies if you use the internal port.

    On the internal port, the gRPC proxy serves only calls addressed to the local app and returns PermissionDenied for other targets.

  • securityPublic-port PUT /v1.0/metadata/{key} removal

    Applies if you send PUT /v1.0/metadata/{key} on the public port.

    The public port now returns 404 for PUT /v1.0/metadata/{key}. Clients use the Dapr HTTP API port for this request instead.

  • securityRequest-host discovery document caching

    Applies if a discovery document is built from the request host.

    The discovery document is built from the validated value. A document built from the request host is now sent with Cache-Control: no-store.

  • securityprimaryEncryptionKey error handling

    Applies if primaryEncryptionKey contains values that would otherwise cause a panic.

    Dapr now returns an error instead of panicking for the affected primaryEncryptionKey values: gRPC Internal or HTTP 500, using the existing state store error code.

  • securityTransactional outbox marker-key validation

    Applies if you use the transactional outbox.

    The transactional outbox subscriber drops messages whose id is not an outbox marker key, outbox-<uuid>, before reading or deleting state, and logs a warning.

  • securityConstant-time DAPR_API_TOKEN comparison

    Applies if you configure DAPR_API_TOKEN.

    The HTTP and gRPC API token checks now use a constant-time comparison.

All 2 other recorded changesfixes 2

fixes (2)

  • The sidecar closes the connection when opening the stream fails, and closes it when the stream ends.
  • Dapr no longer counts timer events in the stored inbox length, and no longer includes them when it computes the inbox keys to save.
Add Dapr to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Dapr releases →