v1.8.6

Date: October 26, 2026

Breaking changes

Security updates

• Bumped envoy to 1.38.8. This includes fixes for CVE-2026-35189, GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j, CVE-2026-54786 and the eMudhra intermediate CA compromise.
• Bumped the Envoy Gateway distroless/base-nossl base image to address the eMudhra intermediate CA compromise.
• Bumped Go to 1.26.10.
• Bumped golang.org/x/net to v0.60.0 to address CVE-2026-97032, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663 and CVE-2026-78669.

New features

Bug fixes

• Fixed the shutdown-manager failing to create /tmp/shutdown-ready (breaking graceful shutdown and delaying proxy pod termination by the full grace period) when the Envoy container’s securityContext sets readOnlyRootFilesystem: true, by mounting a writable emptyDir at /tmp on the shutdown-manager.
• Fixed obsolete resource snapshots being retained by the backing array of coalesced subscription updates.
• Fixed HTTPS listeners referencing non-existent RouteConfigurations when they share a container port with an HTTP listener that is translated first (for example HTTPS on port 443 and HTTP on port 10443). The HTTPS virtual hosts were added to the HTTP listener’s RouteConfiguration, leaving the HTTPS filter chains without routes.
• Fixed route status conditions being reported in a non-deterministic order when a route parent had errors of more than one condition type, which caused unnecessary route status updates.
• Fixed the listener-level api_key_auth filter being built from the first route that uses API key auth. Rotating that route’s keys no longer forces a listener update that drains long-lived connections on every route of the listener, and a route whose credential Secret has no usable keys now rejects requests instead of accepting the first route’s keys.
• Fixed Service and ServiceImport backends whose EndpointSlices carry both kubernetes.io/service-name and multicluster.kubernetes.io/service-name (as Cilium ClusterMesh creates them): ServiceImport backends no longer report EndpointsNotFound, and Service backends now pick up endpoint changes.
• Fixed an HTTPRoute not being reconciled when an HTTPRouteFilter that it references only from backendRef filters is created or updated, if the rule has no rule-level filters.
• Fixed the Kubernetes provider’s cache scope being random on each start when watch.type is Namespaces, which could leave the controller unable to become Ready or unable to see its own namespace’s Secrets and ConfigMaps in Gateway Namespace Mode; the Helm chart now also grants EndpointSlice read in the controller namespace for this mode.
• Fixed the Helm chart not granting Secret and EndpointSlice read in the controller namespace when watch.namespaces is set in the default deploy mode, which kept the controller from becoming Ready unless the controller namespace was listed in watch.namespaces.
• Fixed a BackendTrafficPolicy with mergeType being recorded twice in a route’s policy metadata when two of the route’s parentRefs reach the same listener.
• Fixed route status.parents accumulating duplicate entries until the 32-entry limit when another controller writes status for the same parentRef, by matching parent status entries on both parentRef and controllerName.
• Fixed HTTPRoute, GRPCRoute, TLSRoute and UDPRoute parentRefs being processed in a random order, which could make the translation result non-deterministic when several parentRefs compete for the same listener. ParentRefs are now processed in spec.parentRefs order.

Performance improvements

Deprecations

Other changes