fix(deps): update module github.com/cilium/cilium to v1.18.9 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cilium/cilium	v1.18.1 → v1.18.9

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

CVE-2025-64715 / GHSA-38pp-6gcp-rqvm

More information

Details

Impact

CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended.

Patches

This issue has been patched in:

• Cilium v1.18.4
• Cilium v1.17.10
• Cilium v1.16.17

This issue affects:

• Cilium v1.18 between v1.18.0 and v1.18.3 inclusive
• Cilium v1.17 between v1.17.0 and v1.17.9 inclusive
• Cilium v1.16.16 and below

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​SeanEmac for reporting this issue and to @​fristonio for the patch.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm
• https://nvd.nist.gov/vuln/detail/CVE-2025-64715
• https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97
• https://github.com/cilium/cilium/releases/tag/v1.16.17
• https://github.com/cilium/cilium/releases/tag/v1.17.10
• https://github.com/cilium/cilium/releases/tag/v1.18.4
• https://github.com/advisories/GHSA-38pp-6gcp-rqvm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled

CVE-2026-26963 / GHSA-5r23-prx4-mqg3

More information

Details

Impact

Host Policies will incorrectly permit traffic from Pods on other nodes when all of the following configurations are enabled:

• Native Routing
• WireGuard
• Node Encryption (beta)

These options are disabled by default in Cilium.

Patches

This issue was fixed by #​42892.

This issue affects:

• Cilium v1.18 between v1.18.0 and v1.18.5 inclusive

This issue is fixed in:

• Cilium v1.18.6

Workarounds

There is currently no officially verified or comprehensive workaround for this issue. The following procedure has been validated strictly within a local 'Kind' environment and has not undergone exhaustive testing across diverse production architectures. Proceed with caution.

To mitigate the identified traffic bypass, ensure all ingress traffic from the cilium_wg0 interface is explicitly routed to cilium_host for policy enforcement. This ensures that host-level security policies are applied to decrypted WireGuard traffic. Execute the following configuration on each CiliumNode:

##### IPv4 Traffic
ip rule add iif cilium_wg0 table 300
ip route add default dev cilium_host table 300

##### IPv6 Traffic
ip -6 rule add iif cilium_wg0 table 300
ip -6 route add default dev cilium_net table 300

Acknowledgements

Special thanks to @​julianwiedmann for reporting the issue and helping with the resolution.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/cilium/cilium/security/advisories/GHSA-5r23-prx4-mqg3
• https://github.com/cilium/cilium/pull/42892
• https://github.com/cilium/cilium/commit/88e28e1e62c0b1a02c3f0fc22d888ac9eefbe885
• https://github.com/cilium/cilium/releases/tag/v1.18.6
• https://nvd.nist.gov/vuln/detail/CVE-2026-26963
• https://github.com/advisories/GHSA-5r23-prx4-mqg3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

CVE-2026-33726 / GHSA-hxv8-4j4r-cqgv

More information

Details

Impact

Ingress Network Policies are not enforced for traffic from pods to L7 Services (Envoy, GAMMA) with a local backend on the same node, when Per-Endpoint Routing is enabled and BPF Host Routing is disabled.

Per-Endpoint Routing is disabled by default, but is automatically enabled in deployments using cloud IPAM, including Cilium ENI on EKS (eni.enabled), AlibabaCloud ENI (alibabacloud.enabled), Azure IPAM (azure.enabled, but not AKS BYOCNI), and some GKE deployments (gke.enabled; managed offerings such as GKE Dataplane V2 may use different defaults). It is typically not enabled in tunneled deployments, and chaining deployments are not affected. In practice, Amazon EKS with Cilium ENI mode is likely the most common affected environment.

Patches

This issue was fixed by #​44693.

This issue affects:

• Cilium v1.19 between v1.19.0 and v1.19.1 inclusive
• Cilium v1.18 between v1.18.0 and v1.18.7 inclusive
• All versions of Cilium prior to v1.17.13

This issue is fixed in:

• Cilium v1.19.2
• Cilium v1.18.8
• Cilium v1.17.14

Workarounds

Disclaimer: There is currently no officially verified or comprehensive workaround for this issue. The only option would be to disable per-endpoint routes, but this will likely cause disruptions to ongoing connections, and potential conflicts if running in cloud providers.

Acknowledgements

The Cilium community has worked together with members of the Northflank and Isovalent teams to prepare these mitigations. Cilium thanks @​sudeephb and @​Champ-Goblem for reporting the issue and to @​smagnani96 and @​julianwiedmann for helping with the resolution.

For more information

Anyone who believes a vulnerability affecting Cilium has been found is strongly encouraged to report it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and any such report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/cilium/cilium/security/advisories/GHSA-hxv8-4j4r-cqgv
• https://github.com/cilium/cilium/pull/44693
• https://docs.cilium.io/en/stable/network/concepts/routing/#routing
• https://docs.cilium.io/en/stable/network/kubernetes/policy/#network-policy
• https://docs.cilium.io/en/stable/network/servicemesh/l7-traffic-management
• https://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routing
• https://nvd.nist.gov/vuln/detail/CVE-2026-33726
• https://github.com/advisories/GHSA-hxv8-4j4r-cqgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Cillium exposes sensitive information included in the cilium-bugtool debug archive

CVE-2026-41520 / GHSA-gj49-89wh-h4gj

More information

Details

Impact

The output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled.

Users of WireGuard Transparent Encryption are affected.
The sensitive data is the WireGuard private key (cilium_wg0.key) used for node-to-node encrypted communication

cilium-bugtool is a debugging tool that is typically invoked manually and does not run during the normal operation of a Cilium cluster. It is also invoked when gathering sysdumps using the Cilium CLI's cilium sysdump command.

Patches

This issue affects:

• Cilium v1.19 between v1.19.0 and v1.19.2 inclusive
• Cilium v1.18 between v1.18.0 and v1.18.8 inclusive
• All versions of Cilium prior to v1.17.15

This issue has been patched in:

• Cilium v1.19.3
• Cilium v1.18.9
• Cilium v1.17.15

Workarounds

There is no workaround to this issue.

Users who have previously shared bugtool or sysdump archives from WireGuard-enabled nodes should rotate the WireGuard keys on the affected nodes. This can be done by deleting the key file and restarting the Cilium agent, which will generate a new key pair.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Cillium extends special thanks to @​kodareef5 for reporting the issue and @​tklauser for their work on triaging and remediating this issue.

For more information

If there are any questions or comments about this advisory, please reach out on Slack.

Cilium strongly encourages the reporting of suspected vulnerabilities to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.

Severity

• CVSS Score: 7.9 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

• https://github.com/cilium/cilium/security/advisories/GHSA-gj49-89wh-h4gj
• https://github.com/cilium/cilium/releases/tag/v1.17.15
• https://github.com/cilium/cilium/releases/tag/v1.18.9
• https://github.com/cilium/cilium/releases/tag/v1.19.3
• http://docs.cilium.io/en/stable/security/network/encryption-wireguard
• https://nvd.nist.gov/vuln/detail/CVE-2026-41520
• https://github.com/advisories/GHSA-gj49-89wh-h4gj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

CVE-2026-49445 / GHSA-3fcv-jvfp-m4q9

More information

Details

Impact

When Cilium L7 functionality is enabled on a cluster, the Envoy instance supporting this functionality creates a world-accessible socket on cluster nodes. A local attacker would be able to access Envoy admin endpoints. Depending on deployment configuration, this can expose sensitive information or allow disruptive administrative operations, such as:

• Exposing TLS secrets
• Disrupting traffic in the cluster
• Terminating the Envoy process

This issue affects both the embedded and standalone Envoy deployment models.

Patches

This issue affects:

• Cilium v1.19 between v1.19.0 and v1.19.1 inclusive
• Cilium v1.18 between v1.18.0 and v1.18.7 inclusive
• All versions of Cilium prior to v1.17.14

This issue has been patched in https://github.com/cilium/cilium/pull/44512, included in:

• Cilium v1.19.2
• Cilium v1.18.8
• Cilium v1.17.14

Workarounds

There is no known workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to moemen for reporting the issue and 0xch4z for their work on triaging and remediating this issue.

For more information

If there are any questions or comments about this advisory, please reach out on [Slack (https://docs.cilium.io/en/latest/community/community/).

If anyone thinks they have found a vulnerability affecting Cilium, it is strongly encouraged to report it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as a top priority.

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

References

• https://github.com/cilium/cilium/security/advisories/GHSA-3fcv-jvfp-m4q9
• https://github.com/cilium/cilium/pull/44512
• https://github.com/advisories/GHSA-3fcv-jvfp-m4q9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.18.9: 1.18.9

Compare Source

Summary of Changes

Minor Changes:

• Fix performance bug in L7 policy proxy redirect handling (Backport PR #​44827, Upstream PR #​44613, @​fristonio)
• helm,docs: add configDriftDetection Helm values and documentation (Backport PR #​44972, Upstream PR #​44703, @​PhilipSchmid)

Bugfixes:

• [v1.18] Fix incorrect policy service selector handling (#​44949, @​fristonio)
• Ensure completion.WaitGroup always has a timeout (Backport PR #​45218, Upstream PR #​44731, @​jrajahalme)
• envoy: Fix xds server npds listeners accounting (Backport PR #​45218, Upstream PR #​44830, @​fristonio)
• Fix a slow memory leak triggered by incremental policy updates (Backport PR #​45053, Upstream PR #​44328, @​odinuge)
• Fix endpoints for static pods stuck in init identity (Backport PR #​45213, Upstream PR #​45016, @​aaroniscode)
• Fix memory leak triggered by policies being created and deleted (Backport PR #​44827, Upstream PR #​44724, @​odinuge)
• Fix panic in Hubble Relay when new peer address is unresolvable (Backport PR #​45213, Upstream PR #​45021, @​pesarkhobeee)
• Fixed a bug in dual-stack cluster-pool IPAM where an operator restart with a pre-existing duplicate IPv6 PodCIDR could cause the affected node's IPv4 PodCIDR to be incorrectly freed and reassigned to another node. (Backport PR #​44867, Upstream PR #​44832, @​christarazi)
• Fixed a bug in service load balancing where backend slot assignments could have gaps when maintenance backends exist, potentially causing traffic misrouting. (Backport PR #​44972, Upstream PR #​43902, @​Aman-Cool)
• Fixed an issue where policy update ack is never completed after endpoint deletion. (Backport PR #​44819, Upstream PR #​44754, @​jrajahalme)
• Fixed ipcache identity update hang when last proxy listener is removed. (Backport PR #​45218, Upstream PR #​44597, @​jrajahalme)
• Fixes increased CPU usage in hubble observe caused by log coloring feature, even when coloring was disabled (Backport PR #​44827, Upstream PR #​44119, @​tporeba)
• lb: fix panic in orphan backend cleanup when addr is zero-value (Backport PR #​45053, Upstream PR #​44853, @​vipul-21)
• lb: Skip nil slots during BPF map restore to prevent panic (Backport PR #​44972, Upstream PR #​44895, @​vipul-21)
• operator/identitygc: fix nil pointer dereference on shutdown (Backport PR #​45213, Upstream PR #​45091, @​tsotne95)

CI Changes:

• .github/workflows: disable cache for go steps (Backport PR #​45213, Upstream PR #​45073, @​aanm)
• .github/workflows: replace external set-commit-status action (Backport PR #​45213, Upstream PR #​45078, @​aanm)
• .github: cleanup disk before ci-verifier tests (Backport PR #​45053, Upstream PR #​44971, @​aanm)
• ci: add fail-fast false to ci image builds (Backport PR #​45213, Upstream PR #​45079, @​Artyop)
• ci: set TMPDIR=/host/tmp in datapath verifier tests (Backport PR #​45213, Upstream PR #​45047, @​aanm)
• ci: Switch catchpoint/workflow-telemetry-action to our fork (#​45220, @​YutaroHayakawa)
• fix: escape $ character in regex to prevent injection (Backport PR #​44827, Upstream PR #​44638, @​peoyekunle)

Misc Changes:

• .github/workflows: do not use deployments for environments (Backport PR #​45213, Upstream PR #​44908, @​aanm)
• [v1.18] vendor: update google.golang.org/grpc to v1.79.3 (#​45346, @​aanm)
• bpf: Clear tc_classid on all ingress code paths (Backport PR #​45213, Upstream PR #​42105, @​pchaigno)
• chore(deps): update all github action dependencies (v1.18) (#​44940, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​45042, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​45174, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​45309, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​44833, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.9 (v1.18) (#​45274, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.67.0 (v1.18) (#​45172, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.29 (v1.18) (#​45281, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 1487d0a (v1.18) (#​45040, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.9 docker digest to a95d3d1 (v1.18) (#​45316, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 186072b (v1.18) (#​44935, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 84e77de (v1.18) (#​45306, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.10 (v1.18) (#​45171, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.9 (v1.18) (#​44937, @​cilium-renovate[bot])
• chore(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] (v1.18) (#​45150, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773729248-8de84653be3b2b3011e1cee5b3e702f6556fb3df (v1.18) (#​44938, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1774363526-9d47d40f80df306891816788b71415813ce49ef3 (v1.18) (#​45041, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.5-1775137579-2b3493aca96923190423ccec7e4dbc5f074ccad4 (v1.18) (#​45173, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.6-1775912317-d56e4f5fec87556b7aaf3b8edeb100025ec87183 (v1.18) (#​45308, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa (v1.18) (#​45321, @​cilium-renovate[bot])
• docs: document reverse_sk map exhaustion impact on socket termination (Backport PR #​44861, Upstream PR #​44835, @​ysksuzuki)
• docs: Update Gateway API docs to reference Gateway API v1.3.0 (Backport PR #​44972, Upstream PR #​40825, @​Untersander)
• docs: Update sphinx theme to v3.1.0 (Backport PR #​45338, Upstream PR #​45289, @​joestringer)
• fix(deps): update k8s.io patch updates stable to v0.33.10 (v1.18) (patch) (#​44939, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to 28399d8 (v1.18) (#​44936, @​cilium-renovate[bot])
• fix(deps): update sigs.k8s.io/mcs-api/controllers digest to 4b9911b (v1.18) (#​45170, @​cilium-renovate[bot])

Other Changes:

• [1.18] Reapply "loader: XDP attach type fallback logic" (#​44999, @​rgo3)
• [v1.18 Backport] EKS API Server Hardening (#​44977, @​sekhar-isovalent)
• [v1.18] deps: bump cni plugins to v1.9.1 (#​45241, @​ferozsalam)
• [v1.18] Revert "loader: XDP attach type fallback logic" (#​44857, @​julianwiedmann)
• install: Update image digests for v1.18.8 (#​44956, @​cilium-release-bot[bot])
• v1.18: bpf: Clear tc_classid on all ingress code paths (#​45341, @​pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.9@sha256:c9140c2ebcc636ba346a4152fb28d616a4a51586c22c72dcd6f273bed41053c0

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.9@sha256:140bbb0433dbdb12e3ab0aaca0cb6fd1a8430812816ccff54c0d7f0adb713175

docker-plugin

quay.io/cilium/docker-plugin:v1.18.9@sha256:da9e6d08f8c11624619692af7ae022b2a7e8e1136d9164910bc6776acdc60079

hubble-relay

quay.io/cilium/hubble-relay:v1.18.9@sha256:031288422f2b0bfff3372fba9812d2867dd9262a6f12c6e6282cfebe54e5efe1

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.9@sha256:2116cd9ec94484a1bb7f5cb9703fb6d7c4e63b11431cf145280abda218f3e8b9

operator-aws

quay.io/cilium/operator-aws:v1.18.9@sha256:48d78a4d22fc055a2223019941fc30a51f8a980691e55225bfd6b9cffb164a45

operator-azure

quay.io/cilium/operator-azure:v1.18.9@sha256:4523175c9452c2eab7fa537faa85654120e29b740843f72d55b43c5cbc774f71

operator-generic

quay.io/cilium/operator-generic:v1.18.9@sha256:9094fe19965c558bc9361aa4f0d19fcc48f7377f835dc70f138bf4dc1db48ca4

operator

quay.io/cilium/operator:v1.18.9@sha256:da7b86562f4db18d61e6d34bb1f998d826f993af9d2047bf3e0b7346f658d65c

v1.18.8: 1.18.8

Compare Source

Known issues

• Users who deploy Cilium on GKE should skip this version or upgrade to 1.19.2 due to a known regression.

Summary of Changes

Minor Changes:

• Allow to attach Cilium's XDP program on network interfaces that have jumbo MTU configured and support xdp.frags program type. (Backport PR #​44499, Upstream PR #​41967, @​viktor-kurchenko)

Bugfixes:

• bpf: nodeport: use hairpin redirect for L7 LB on bridge devices (Backport PR #​44758, Upstream PR #​44658, @​smagnani96)
• cilium-dbg: fix seg-fault ip get -l reserved:host (Backport PR #​44519, Upstream PR #​44443, @​aanm)
• Enable Cilium upgrade and downgrade when existing XDP attach types differ from new XDP programs (Backport PR #​44499, Upstream PR #​44209, @​dylandreimerink)
• Fix a bug where node IPv6 updates and deletes were not correctly propagated to the Linux kernel neighbor subsystem. (Backport PR #​44592, Upstream PR #​44540, @​tklauser)
• Fix a bug where removed addresses from EndpointSlices might be missed if multiple EndpointSlices share the same name (Backport PR #​44021, Upstream PR #​43999, @​EmilyShepherd)
• Fix envoy admin socket being created as world-accessible (Backport PR #​44592, Upstream PR #​44512, @​0xch4z)
• Fixed an issue where wildcard FQDN network policy identities were not correctly pushed to Envoy when using SNI-based policies. (Backport PR #​44519, Upstream PR #​44462, @​liyihuang)
• Fixed VTEP ARP responses returning 00:00:00:00:00:00 MAC due to interface MAC missing from eBPF Overlay configuration. (Backport PR #​44700, Upstream PR #​44513, @​akos011221)
• gateway-api: Fix hostname intersection bug that was preventing cert-manager challenges from working correctly. (Backport PR #​44519, Upstream PR #​44492, @​youngnick)
• l7lb: fix bypassing ingress policies for local backends (Backport PR #​44804, Upstream PR #​44693, @​smagnani96)
• loadbalancer/healthserver: refresh ProxyRedirect per request (Backport PR #​44399, Upstream PR #​44286, @​mhofstetter)

CI Changes:

• gh: e2e-upgrade: don't hardcode IPsec encryption algorithm (Backport PR #​44519, Upstream PR #​44381, @​julianwiedmann)

Misc Changes:

• chore(deps): update all github action dependencies (v1.18) (#​44372, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44480, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44579, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44681, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44791, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​44369, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​44580, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​44678, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.8 (v1.18) (#​44810, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.1 (v1.18) (#​44344, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.1 (v1.18) (#​44401, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.2 (v1.18) (#​44577, @​cilium-renovate[bot])
• chore(deps): update dependency sphinx-tabs to v3.5.0 (v1.18) (#​44679, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/ubuntu:24.04 docker digest to d1e2e92 (v1.18) (#​44476, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to e3f9456 (v1.18) (#​44797, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f512d81 (v1.18) (#​44575, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.8 (v1.18) (#​44370, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.1 (v1.18) (#​44680, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663 (v1.18) (#​44371, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1771585526-532310e626e42c7086de4ef3ea913736125bbd31 (v1.18) (#​44478, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773220507-ffc0948a7ec4868e6b552a71cf4d3860e78b53cc (v1.18) (#​44676, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773405792-4046425704636ea5b770460c20c065069cf572dc (v1.18) (#​44789, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be (v1.18) (#​44807, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44252, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44479, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44677, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​44790, @​cilium-renovate[bot])
• Docs: improve docs around ipsec upgrade in 1.18 (Backport PR #​44399, Upstream PR #​44302, @​darox)
• fix(deps): update k8s.io patch updates stable (v1.18) (#​44477, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.33.9 (v1.18) (patch) (#​44578, @​cilium-renovate[bot])
• fix(deps): update sigs.k8s.io/mcs-api/controllers digest to 0f775a3 (v1.18) (#​44576, @​cilium-renovate[bot])
• fix(deps): update sigs.k8s.io/mcs-api/controllers digest to 15301c2 (v1.18) (#​44675, @​cilium-renovate[bot])
• loadbalancer/healthserver: stabilize proxy-redirect test (Backport PR #​44519, Upstream PR #​44323, @​mhofstetter)

Other Changes:

• [1.18] gha: Use eks 1.32 from us-west-2 (#​44753, @​sayboras)
• [v1.18] endpoint/bpf: remove change empty condition for updateEnvoy (#​44616, @​liyihuang)
• [v1.18] gh: verifier: disable RHEL8 (#​44317, @​julianwiedmann)
• [v1.18] loadbalancer: Fix flake in hybrid-dsr.txtar (#​44756, @​julianwiedmann)
• install: Update image digests for v1.18.7 (#​44326, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.8@sha256:070a63cc414869cf6c53202cb50929a87adb7d5b25de0f2f40ab39eb6434b706

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.8@sha256:5cb08daad7397f52ce5c36fcbfe83c56494f340d9b8f10f8bc7a3f2a812c33d5

docker-plugin

quay.io/cilium/docker-plugin:v1.18.8@sha256:8e1c89bc4ef3bbc55a10edc96a9f2915af45181e46ff189c00f3d8fb7825a0b7

hubble-relay

quay.io/cilium/hubble-relay:v1.18.8@sha256:dcf324aa35ab59c8fe6d002e3df6a63fff18280da464d09e4a97d58c085bb015

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.8@sha256:36c1702c8afd0b0221e3d88ca08537100caef509de6a6bb7244d5fa4643a7252

operator-aws

quay.io/cilium/operator-aws:v1.18.8@sha256:7ab154b269eae378456d63cc9085d96c4f472e11a1496ca4c62af68ff4b31da3

operator-azure

quay.io/cilium/operator-azure:v1.18.8@sha256:a4027d349e817bda9168af1e27231be491a3026c748128a79026e366321f6332

operator-generic

quay.io/cilium/operator-generic:v1.18.8@sha256:f9d1715932751b1454d0f59b492497cb1636dea6335beab0f9026fa8b5a6f62f

operator

quay.io/cilium/operator:v1.18.8@sha256:cc3f7bdf9e443b807d3cb9b0bd30eddac5591c3f4b1e6fa053bfaa8697a7ee58

v1.18.7: 1.18.7

Compare Source

Summary of Changes

Minor Changes:

• Exclude topology.kubernetes.io labels from security labels by default (Backport PR #​43777, Upstream PR #​43725, @​moscicky)
• hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error) (Backport PR #​44004, Upstream PR #​43644, @​puwun)

Bugfixes:

• Add permissions to the cilium-operator so that it can create EndpointSlices when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #​44034, Upstream PR #​43912, @​fgiloux)
• bpf: Correct refinement of inner packet L4 checksum detection (Backport PR #​43923, Upstream PR #​43868, @​br4243)
• bpf: Fix marker to skip nodeport when punting to proxy (Backport PR #​43886, Upstream PR #​43069, @​borkmann)
• clustermesh: correctly phase out not ready/not service endpoints from global services (Backport PR #​44056, Upstream PR #​43807, @​MrFreezeex)
• Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #​43756, Upstream PR #​43095, @​aditighag)
• Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic. (Backport PR #​43861, Upstream PR #​43196, @​yushoyamaguchi)
• Grant permissions to the cilium-operator so that it can reconcile ingresses when the when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #​44034, Upstream PR #​43949, @​giorio94)
• helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #​44281, Upstream PR #​44159, @​puwun)
• loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B (Backport PR #​43777, Upstream PR #​43620, @​imroc)
• Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations (Backport PR #​44281, Upstream PR #​43517, @​pasteley)

CI Changes:

• fix(ctmap/gc): fix race conditions and flakiness in TestGCEnableRatchet (Backport PR #​44056, Upstream PR #​42009, @​AritraDey-Dev)
• gh: ariane: don't run cloud workflows for LVH kernel updates (Backport PR #​44148, Upstream PR #​44109, @​julianwiedmann)
• gh: ariane: skip more workflows for LVH kernel updates (Backport PR #​44148, Upstream PR #​44115, @​julianwiedmann)
• gha: let CiliumEndpointSlice migration be run nightly on stable branches (Backport PR #​44004, Upstream PR #​43921, @​giorio94)
• gke: lower scope of ESP firewall rule (Backport PR #​43865, Upstream PR #​43691, @​marseel)

Misc Changes:

• .github/workflows: use proper directory structure for GH actions (#​43760, @​aanm)
• chore(deps): update all github action dependencies (v1.18) (#​43845, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43984, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44099, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​44253, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​43839, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43840, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43983,

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/go-viper/mapstructure/v2	v2.3.0 -> v2.4.0

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
cel.dev/expr	v0.24.0 -> v0.25.1
github.com/cilium/ebpf	v0.19.0 -> v0.20.1-0.20260218191617-ee67e7f43dd9
github.com/cilium/statedb	v0.4.5 -> v0.4.6
github.com/go-jose/go-jose/v4	v4.1.3 -> v4.1.4
github.com/vishvananda/netlink	v1.3.1 -> v1.3.2-0.20250926155043-cd3cb2e12c97
google.golang.org/grpc	v1.78.0 -> v1.79.3
k8s.io/kubectl	v0.33.3 -> v0.33.10
k8s.io/utils	v0.0.0-20260108192941-914a6e750570 -> v0.0.0-20260319190234-28399d86e0b5