v1.8.6

Updated Envoy Gateway to v1.8.6.

Security Updates

• Bumped Envoy to v1.38.9 (from v1.38.4), which includes the fixes for CVE-2026-35189 (BoringSSL excessive memory allocation when parsing certificate CRL distribution points), GHSA-8vc2-jrm4-835w and GHSA-47vj-9r25-wv5j (crashes in the OAuth2 and API key auth filters on requests without a :path header) and CVE-2026-54786, and drops the compromised eMudhra intermediate CAs from the trusted CAs of the Envoy image. Refer to the Envoy v1.38.8 and Envoy v1.38.9 release notes.
• Bumped the OS base of the distroless and FIPS Envoy images to a digest whose CA bundle (Debian ca-certificates 20250419+deb13u1) no longer trusts the compromised eMudhra roots. These images take their CA bundle from the OS base rather than from the upstream Envoy image, so the Envoy bump alone would have left those chains trusted.
• Bumped the Go toolchain to 1.26.10, fixing CVE-2026-56857, CVE-2026-56866, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78667, CVE-2026-78669, CVE-2026-94439, CVE-2026-94440, CVE-2026-94444, CVE-2026-94447, CVE-2026-94448, CVE-2026-97030, CVE-2026-97031, CVE-2026-97032 and CVE-2026-111943 in the Go standard library. The new toolchain also rejects certificate chains that run through eight compromised eMudhra intermediate CAs.
• Bumped golang.org/x/net to v0.60.0, fixing CVE-2026-97032, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663 and CVE-2026-78669.
• The data-plane fixes above already shipped as the envoy/v1.8.5.2 to envoy/v1.8.5.5 data-plane sub-patches, and the Go toolchain fix as the control-plane/v1.8.5.2 control-plane sub-patch. v1.8.6 is the first full release that bundles them.

Bug Fixes

• Fixed the shutdown manager failing to create /tmp/shutdown-ready when the Envoy container's securityContext sets readOnlyRootFilesystem: true, which broke graceful shutdown and delayed proxy pod termination by the full grace period. A writable emptyDir is now mounted at /tmp on the shutdown manager.
• Fixed obsolete resource snapshots being retained by the backing array of coalesced subscription updates.
• Fixed HTTPS listeners referencing non-existent RouteConfigurations when they share a container port with an HTTP listener that is translated first (for example HTTPS on port 443 and HTTP on port 10443). The HTTPS virtual hosts were added to the HTTP listener's RouteConfiguration, leaving the HTTPS filter chains without routes.
• Fixed route status conditions being reported in a non-deterministic order when a route parent had errors of more than one condition type, which caused unnecessary route status updates.
• Fixed the listener-level api_key_auth filter being built from the first route that uses API key auth. Rotating that route's keys no longer forces a listener update that drains long-lived connections on every route of the listener, and a route whose credential Secret has no usable keys now rejects requests instead of accepting the first route's keys.
• Fixed Service and ServiceImport backends whose EndpointSlices carry both kubernetes.io/service-name and multicluster.kubernetes.io/service-name (as Cilium ClusterMesh creates them): ServiceImport backends no longer report EndpointsNotFound, and Service backends now pick up endpoint changes.
• Fixed an HTTPRoute not being reconciled when an HTTPRouteFilter that it references only from backendRef filters is created or updated, if the rule has no rule-level filters.
• Fixed the Kubernetes provider's cache scope being random on each start when watch.type is Namespaces, which could leave the controller unable to become Ready or unable to see its own namespace's Secrets and ConfigMaps in Gateway Namespace Mode. The Helm chart now also grants EndpointSlice read in the controller namespace for this mode.
• Fixed the Helm chart not granting Secret and EndpointSlice read in the controller namespace when watch.namespaces is set in the default deploy mode, which kept the controller from becoming Ready unless the controller namespace was listed in watch.namespaces.
• Fixed a BackendTrafficPolicy with mergeType being recorded twice in a route's policy metadata when two of the route's parentRefs reach the same listener.
• Fixed route status.parents accumulating duplicate entries until the 32-entry limit when another controller writes status for the same parentRef, by matching parent status entries on both parentRef and controllerName.
• Fixed HTTPRoute, GRPCRoute, TLSRoute and UDPRoute parentRefs being processed in a random order, which could make the translation result non-deterministic when several parentRefs compete for the same listener. ParentRefs are now processed in spec.parentRefs order.
• The WAF dynamic module (BOE composer 0.13.0) now moves to Coraza v3.8.1 and the coraza-coreruleset multi-module, releases the WAF transactions of upgraded and SSE streams once their analysis is done, passes the request path rather than an absolute URL as REQUEST_URI, and fixes including embedded @ files from directories whose name contains @.

Other Changes

• Bumped Envoy Gateway to v1.8.6.
• Bumped Envoy to v1.38.9, one patch ahead of the v1.38.8 that Envoy Gateway v1.8.6 defaults to. v1.38.9 only moves the upstream distroless image to the patched CA bundle, which the TEG Envoy images already used.
• Bumped the Ubuntu 22.04 base of the regular (non-distroless) Envoy image to its latest digest.
• Bumped the BOE composer dynamic module to 0.13.0.
• Bumped Helm to 3.22.1.