# Dapr v1.18.9

> Orchestration & Management · 2026-10-21

A security release that prevents cross-application resource and secret disclosure in the operator. It also enforces pod annotations, labels, and container naming for manually run `daprd` instances in Kubernetes mode without the injector.

## Check if affected
- **[security]** Operator resource scoping and secret resolution
  - Applies if a resource's `scopes` do not include the calling app ID.
  - Operator resource lookups now skip resources whose `scopes` do not include the calling app ID before resolving secrets. `GetResiliency` reports those resources as not found.
- **[security]** Manual Kubernetes `daprd` pod identity requirements
  - Applies if you run `daprd` in Kubernetes mode, do not use the injector, and pass `--config`.
  - The pod must have the `dapr.io/enabled: "true"`, `dapr.io/app-id`, and `dapr.io/config` annotations plus the `dapr.io/app-id` label, and its container must be named `daprd`. Without these requirements, the operator refuses the configuration and `daprd` fails to start.

[Full analysis](https://ratatosk.io/en/releases/dapr/v1.18.9)

[Original release notes](https://github.com/dapr/dapr/releases/tag/v1.18.9)