RATATOSKRATATOSK
Sign in

Emissary-Ingress

v4.2.0Networking & Messaging
Nov 10, 2026

ACTION 2CHECK 8OTHER 13

A security- and correctness-focused release changes internal API exposure, Envoy defaults, and configuration validation. It also includes routing, protocol, dependency, and chart updates, with behavior changes for deployments that rely on previously tolerated settings.

Action needed (2)

  • securityTrust for the eMudhra intermediate CAs removed

    The image's CA bundle no longer trusts the compromised eMudhra intermediate CAs.

  • securityThe diagd internal API is no longer reachable through admin port 8877

    The diagd internal API, including POST /_internal/v0/watt, is no longer reachable through the admin port 8877.

Check if affected (8)

  • securityLatin-1 matching for Mapping regular expressions

    Applies if you configure prefix_regex, regex_headers, or regex_rewrite.

    Regular expressions in Mappings, including prefix_regex, regex_headers, and regex_rewrite, are now matched in Latin-1 mode rather than UTF-8. This change is associated with CVE-2026-73552.

  • securityThe AMBASSADOR_DIAGD_BIND_PORT and AMBASSADOR_DIAGD_BIND_ADDREASS variables removed

    Applies if you configure AMBASSADOR_DIAGD_BIND_PORT or AMBASSADOR_DIAGD_BIND_ADDREASS.

    The AMBASSADOR_DIAGD_BIND_PORT and AMBASSADOR_DIAGD_BIND_ADDREASS environment variables are removed because they no longer configure anything.

  • securityThe unsanitized snapshot server removed

    Applies if you use kubectl port-forward to reach the snapshot server.

    The snapshot server that listened on localhost:9696 is removed. It served the unsanitized snapshot, including secrets, and was reachable with kubectl port-forward.

  • breakingEnvoy worker-thread sizing by cgroup CPU limit

    Applies if you do not set ENVOY_CONCURRENCY.

    When ENVOY_CONCURRENCY is not set, Envoy sizes its worker threads to the container's cgroup CPU limit instead of the node's CPU count.

  • breakingX25519MLKEM768 added to default TLS ECDH curves

    Applies if you do not set ecdh_curves.

    X25519MLKEM768 is now one of the default TLS ECDH curves for Hosts and TLSContexts that do not set ecdh_curves.

  • breakingThe error_response_overrides mechanism disabled

    Applies if you configure error_response_overrides.

    The Ambassador Labs error_response_overrides mechanism is disabled. Attempts to use it now produce an error.

  • breakingLookups constrained to the named datacenter

    Applies if you configure datacenter.

    Lookups now query the named datacenter. A wrong datacenter value that previously happened to work will stop resolving.

  • breakingConflicting hostPort values for a targetPort rejected

    Applies if you configure hostPort and targetPort.

    Different hostPort values for the same targetPort are now rejected.

All 13 other recorded changesfixes 6 · value changes 4 · additions 2 · constraints 1

fixes (6)

  • Weighted TCPMappings now divide traffic in the ratio they are configured with.
  • apiext now eagerly generates its webhook server certificate for its well-known Service hostname as part of its readiness check
  • Two ConsulResolvers in different datacenters that watch services with the same name no longer overwrite each other's endpoints.
  • The Helm chart no longer declares the same containerPort twice when several service.ports share a targetPort
  • Two Mappings for the same service, one using the default Kubernetes service resolver and one using an endpoint resolver, no longer share one Envoy cluster.
  • An add_request_headers or add_response_headers entry written as an object with no value (for example cache-control: {append: true}) no longer crashes Emissary.

value changes (4)

  • Update: Upgrade from Envoy 1.37.2 to Envoy 1.40.2
  • The x-envoy-upstream-stream-duration-ms request header is now stripped from external requests
  • Emissary is now built with Go 1.27.3 and the Kubernetes 1.37 client libraries, and its other Go and Python dependencies are updated to their current releases.
  • diagd now posts Ingress and other resource status updates from threads rather than from forked worker processes, so the Emissary pod no longer runs five extra diagd processes once the first status update is posted.

additions (2)

  • TLSContexts and the tls settings of a Host now accept signature_algorithms
  • The emissary-crds chart can now schedule the emissary-apiext Deployment with apiext.nodeSelector and apiext.tolerations.

constraints (1)

  • The HTTP/1 QUERY method is now forwarded upstream rather than rejected with a 400.
Add Emissary-Ingress to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Emissary-Ingress releases →