RATATOSKRATATOSK
Sign in

Dapr

v1.18.9Orchestration & Management
Oct 21, 2026

CHECK 2

A security release that prevents cross-application resource and secret disclosure in the operator. It also enforces pod annotations, labels, and container naming for manually run `daprd` instances in Kubernetes mode without the injector.

Check if affected (2)

  • securityOperator resource scoping and secret resolution

    Applies if a resource's scopes do not include the calling app ID.

    Operator resource lookups now skip resources whose scopes do not include the calling app ID before resolving secrets. GetResiliency reports those resources as not found.

  • securityManual Kubernetes daprd pod identity requirements

    Applies if you run daprd in Kubernetes mode, do not use the injector, and pass --config.

    The pod must have the dapr.io/enabled: "true", dapr.io/app-id, and dapr.io/config annotations plus the dapr.io/app-id label, and its container must be named daprd. Without these requirements, the operator refuses the configuration and daprd fails to start.

Add Dapr to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Dapr releases →