Tetrate Service BridgeVersion: 1.12.x

Release Notes

Version 1.12.15

Fixed the following CVEs: CVE-2023-44487, CVE-2025-15661, CVE-2025-45582, CVE-2025-60876, CVE-2025-68384, CVE-2026-11850, CVE-2026-12061, CVE-2026-12072, CVE-2026-12074, CVE-2026-12075, CVE-2026-13346, CVE-2026-13505, CVE-2026-34743, CVE-2026-39822, CVE-2026-39824, CVE-2026-4046, CVE-2026-42505, CVE-2026-4437, CVE-2026-4438, CVE-2026-45292, CVE-2026-46600, CVE-2026-47204, CVE-2026-47207, CVE-2026-47221, CVE-2026-47778, CVE-2026-48042, CVE-2026-48044, CVE-2026-48090, CVE-2026-48497, CVE-2026-48706, CVE-2026-48743, CVE-2026-48978, CVE-2026-49844, CVE-2026-50163, CVE-2026-54293, CVE-2026-54515, CVE-2026-55199, CVE-2026-55200, CVE-2026-55831, CVE-2026-55833, CVE-2026-56144, CVE-2026-56145, CVE-2026-56148, CVE-2026-56149, CVE-2026-56745, CVE-2026-56746, CVE-2026-56819, CVE-2026-56852, CVE-2026-58055, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472, CVE-2026-59890, CVE-2026-59901, CVE-2026-59903, CVE-2026-63136, CVE-2026-63140, CVE-2026-63144, CVE-2026-63263, CVE-2026-71497, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-9079, CVE-2026-9080, CVE-2026-9545, CVE-2026-9547, GHSA-gcjh-h69q-9w9g, GHSA-hrxh-6v49-42gf, GHSA-jpcw-4wr7-c3vq, GHSA-mfg7-5gfp-c4w3, GHSA-r277-6w6q-xmqw, GO-2026-6061, XRAY-1032218, XRAY-1032959, XRAY-1032960, XRAY-1032970, XRAY-1032971, XRAY-1033007, XRAY-1034530, XRAY-1034531, XRAY-1035464, XRAY-1035817, XRAY-1035820, XRAY-1041237, XRAY-1046408, XRAY-1046409, XRAY-1047060, XRAY-1047069, XRAY-1047072, XRAY-1047073, GO-2026-5024
Fixed an issue where GitOps would permanently stop reconciling a TSB resource (status Stalled: TSBApplyNonRetriableError) when a sibling resource's state had not yet caught up. The bridge now returns FailedPrecondition for cross-resource validation errors (e.g. a Group's selectors not yet contained in its Workspace's selectors), and the GitOps controller surfaces this as a new retriable condition reason TSBApplyRetryPending. After 90 seconds of consecutive failures the condition flips to TSBApplyNonRetriableError, so a genuine user misconfiguration still surfaces as terminal instead of looping forever. PermissionDenied (e.g. during the GitOps service-account bootstrap) now shares the same bounded-TTL path. InvalidArgument continues to be immediately terminal for genuinely malformed requests.
Fixed an intermittent management plane installation failure where the TSB operator could permanently fail to apply the embedded postgres (Kubegres) resource with the error "unable to add content hash". When the randomly generated TLS secret hash consisted only of digits, the unquoted annotation value in the rendered manifest was parsed as a number instead of a string. The hash annotations are now always rendered as strings, and content hashing reports the offending annotation instead of failing with a nil error.
Fixed the Tetrate Management Plane operator taking up to ~16 minutes to report the ManagementPlane as INSTALLED after a transient error during a fresh install, even once all components had become healthy. The operator now re-reconciles on a short bounded interval until the install converges, so the status reflects readiness within seconds.
Fixed an issue where a fresh management plane or control plane install could remain in the INSTALLING phase for several minutes after every component was already healthy. Transient errors during convergence (for example a dependency CRD not yet registered, or a component Deployment still cold-starting) caused the operator to requeue with exponential backoff that grew to ~16 minutes, so it stopped re-checking the now-healthy components and was late to set INSTALLED. The operator now requeues these still-converging conditions on a short, bounded interval and caps its worst-case requeue backoff, so the install reaches INSTALLED shortly after the last component becomes ready.
Security: The tetrate-openldap image used by the demo installation is now built on Alpine instead of Debian. Alpine does not ship Linux-PAM, which removes CVE-2025-8941 and the rest of the Linux-PAM vulnerability surface from the image. OpenLDAP is also updated from 2.6.8 to 2.6.13 and the image size drops from roughly 450MB to 13MB.
The management plane policy decision point (PDP) now uses NGAC's compiled integer decision engine, lowering authorization decision latency and memory allocation on large policy graphs (roughly 3.6x faster List with 2.6x fewer allocations at the 25k-node tier). The change is behavior-preserving and parity-verified against the previous decision engine.
The operator admin server port is now configurable via the operator.adminPort Helm value (default: 5555). For example:
```
operator:
  adminPort: 5556
```
The operator's Prometheus metrics and health-check ports are now configurable via the operator.metricsPort (default: 8383) and operator.healthPort (default: 9082) Helm values. This matters most under operator.deployment.hostNetwork: true, where these ports are bound on the node itself rather than in the pod's network namespace. For example:
```
operator:
  metricsPort: 8384
  healthPort: 9083
```
Improved the performance of recursive audit log queries (tctl audit <resource> --recursive) and other organization-wide queries. Permission evaluation now loads the access-control graph in a single bulk read instead of issuing one database query per resource, reducing response times on large organizations from minutes to seconds.
Added a top-level terminationGracePeriodSeconds field to the Gateway install resource (alongside connectionDrainDuration). It sets the gateway pod's termination grace period directly, removing the need for a custom Deployment overlay when the proxy is configured to drain for longer than the default.

When unset, the grace period continues to default to the connection drain duration plus 5 seconds (connectionDrainDuration + 5s). When set, it should be greater than or equal to the proxy's drain duration so in-flight connections can finish draining before Kubernetes force-kills the pod.
Fixed non-deterministic packaging of the controlplane and managementplane Helm charts that could occasionally produce chart archives with extraneous, non-installable files.
Fixed extra-crds.yaml (the reference list of TSB CRDs) being missing from the managementplane chart archive; it was previously only included in the controlplane chart.
Improved TSB API performance on large service registries, both for read operations such as listing services and for registering new services.

The compiled authorization decision engine keys its read-model by graph version and discards it whenever the graph changes, so a write could trigger a whole-graph rebuild on the next authorization decision. That rebuild is now deferred until the graph has been unchanged for a short window. Authorization decisions made while a rebuild is deferred are served by the previous decision engine, which reads the live graph, so they remain correct and observe every write that has landed.

The debounce window defaults to 1 second and can be tuned:
- --q-compiled-rebuild-debounce on the TSB API server, or
- the TSB_Q_COMPILED_REBUILD_DEBOUNCE environment variable, which can be set alongside the existing container configuration without editing CLI arguments.
Both take a Go duration such as 250ms or 2s. A value of 0 rebuilds the read-model on the next decision after any change. An unparseable or negative environment value is ignored and logged, and the default is used.

Two metrics report the tuning's health. A graph that mutates continuously faster than the debounce window never rebuilds its read-model, which forfeits the read improvement:
- pdp_compiled_rebuild_deferral counts how often the graph starts changing continuously.
- pdp_compiled_rebuild_deferred_seconds reports how long the current continuous episode has lasted. Sustained growth in this gauge means the debounce window should be lowered.
This release also upgrades the NGAC library to v0.1.3, which further reduces authorization traversal cost, and upgrades google.golang.org/grpc from 1.81.1 to 1.82.1 as a required dependency of that upgrade.
Improved the consistency of the management plane's in-memory authorization cache by resolving read-after-write concurrency issues, so recently committed permission and policy changes are immediately reflected in subsequent authorization decisions.
Added support for the SameSite attribute on OIDC authentication cookies via the new cookieConfig.sameSite field in OIDCConfig. The value is applied to all cookies the proxy sets during the OIDC flow. Defaults to unset (the attribute is not added).
The operator deployment can now run with hostNetwork: true via the operator.deployment.hostNetwork Helm value, instead of requiring a manual kubectl patch after install. This is needed on some CNIs (e.g. Cilium with kube-proxy replacement on EKS) where the API server cannot reach pod IPs directly for admission webhooks. When enabling this, also set operator.webhookPort and operator.adminPort (and operator.metricsPort/operator.healthPort, see below) to ports that don't conflict with other host-networked components. The deployment strategy defaults to Recreate when hostNetwork is enabled (unless operator.deployment.strategy is set explicitly), since a surging RollingUpdate pod can otherwise land on the same node as the pod it's replacing and fail to bind the still-held host ports. Note that hostNetwork: true is rejected by Pod Security Admission at the baseline/restricted levels, so the operator's namespace must permit host namespaces when enabling this. For example:
```
operator:
  deployment:
    hostNetwork: true
  webhookPort: 9444
  adminPort: 5556
```
Bumped the indirect dependency oras.land/oras-go/v2 from v2.6.0 to v2.6.1 to fix CVE-2026-48978, where a malicious OCI registry could hijack the Bearer token realm to exfiltrate credentials and refresh tokens.
Added a new metric, ngac_pdp_decision_source, reporting which backend served each management plane authorization decision. The decision_source label separates decisions answered from the in-memory authorization cache (runtime_cache) from those served by the database (transactional_db for decisions made inside a transaction, and disabled_db_base/disabled_db_tx when the cache is turned off), and the method label identifies the authorization operation. Together these make it possible to confirm the cache is serving traffic and to pinpoint which operations are responsible when it is not, since database-served decisions are the main contributor to authorization latency. Decisions not served from the cache are additionally logged at debug level.
Added priorityClassName support to ControlPlane and ManagementPlane CR specs. Setting spec.components.defaultKubeSpec.deployment.priorityClassName applies a Kubernetes PriorityClass to the operator-managed component deployments, ensuring mesh control-plane components receive scheduling priority over application workloads. Per-component overrides via spec.components.<component>.kubeSpec.deployment.priorityClassName take precedence over the global default. The cert-manager pods (controller, webhook, cainjector) also honour the global default via the chart's global.priorityClassName; per-cert-manager-component overrides are not applied since the chart exposes only a single global value. Note: ECK/Elasticsearch and kubegres are installed from external charts and are not covered.
Fixed an issue where the management plane could occasionally report a misleading "context canceled" error instead of a clear shutdown status while segmentation ACL processing was stopping.
Upgraded curl (>= 8.18.0-1ubuntu2.2) and libnghttp2-14 (>= 1.68.0-2ubuntu0.2) OS packages in the spm-user and spm-central images to fix multiple curl and nghttp2 CVEs.
The ControlPlane now supports a strictClientMtls setting that enforces strict mTLS on the client side across clusters. When enabled, sidecars originate ISTIO_MUTUAL to all mesh-internal upstreams unless an explicit DestinationRule tls setting opts out, closing the plaintext fallback that Istio auto-mTLS leaves open for non-injected and cross-cluster destinations.

Enabling it also lets XCP Edge stop generating the per-host force-mTLS DestinationRules it used to create for authentication.trafficMode: REQUIRED hosts, which significantly reduces the number of DestinationRules in large meshes.

It can be set per Istio revision under xcp.isolationBoundaries, so it can be rolled out one revision at a time.

Note that non-injected or plaintext-only workloads fail closed once this is enabled. Exempt them by marking them authentication.trafficMode: OPTIONAL, which makes XCP Edge emit a tls: DISABLE DestinationRule for them.

Example configuration:
```
spec:
  components:
    xcp:
      isolationBoundaries:
        - name: global
          revisions:
            - name: default
              istio:
                strictClientMtls: true
```
Fixed a spurious translation error reported for ambient namespaces when a Workspace defines a defaultTrafficSetting. XCP Edge unconditionally attached an empty (but non-nil) legacy Resilience block to every workspace-level default traffic setting, which the legacy-to-new API conversion then expanded into a phantom catch-all upstreamTrafficSettings entry (hosts: ["*"]) carrying no user-provided content. In a namespace containing ambient services this phantom entry tripped the "upstream traffic setting is not supported in ambient mode" check, marking that namespace's config ERRORED -- and therefore the aggregated Workspace status ERRORED at XCP Central -- even though no upstream traffic setting was ever configured and all generated Istio config was still applied correctly on every target cluster. XCP Edge now carries the legacy Resilience block forward only when it is actually set, so no phantom upstreamTrafficSettings entry is produced and ambient namespaces are no longer falsely reported as errored.
XCP Central now exposes a /live liveness endpoint on the monitoring port, and the central Deployment is configured with a Kubernetes livenessProbe pointing at it. The endpoint dials Central's own relay gRPC port and invokes the standard gRPC health service, so a Central instance that stops accepting or answering connections from MPC/edges is automatically restarted by the kubelet.
Fixed cross-cluster failover failing with a TLS error (SSL certificate validation failed) for a service that runs in the local cluster and is also reachable on remote clusters through an east-west gateway, when the service is configured with required mTLS (a TrafficSetting with authentication.trafficMode: REQUIRED). Previously, once the local endpoints were taken out of rotation (for example by outlier detection), requests that failed over to a remote cluster were rejected because the client did not accept the remote cluster's workload identity. XCP Edge now accepts the workload identities of all clusters that back the service, and applies the service's configured locality failover, so cross-cluster failover completes over mTLS as expected. The fix is enabled by default; it can be turned off per cluster by setting the environment variable ENABLE_NON_INJECTED_MTLS_EAST_WEST_ALIGNMENT to false on XCP Edge.
Added a kubeSpec.deployment.terminationGracePeriodSeconds field to the gateway install resources. It sets the pod-level termination grace period directly, removing the need for a custom Deployment overlay when the proxy is configured to drain for longer than the default.

When unset, the grace period continues to default to the connection drain duration plus 5 seconds (connectionDrainDuration + 5s). When set, it should be greater than or equal to the proxy's drain duration so in-flight connections can finish draining before Kubernetes force-kills the pod.
XCP Edge now compresses its gRPC traffic to XCP Central with gzip (cluster state uploads, and — since the server responds with the same codec — config and cluster state pushes back to the edge). Measured on a 1,000-service cluster state, this reduces bytes on the wire by ~21x for full cluster state pushes with no measurable CPU or memory cost at Central. Controlled by the new ENABLE_GRPC_COMPRESSION_TO_CENTRAL environment variable on XCP Edge (default true). XCP Central must be upgraded before Edges (the standard upgrade order); set the variable to false on Edges that must connect to an older Central.
Fixed an issue where the OIDC authorization-code token exchange could fail with a protocol_error against an HTTP/2-capable identity provider. The generated upstream cluster for the OIDC token/JWKS endpoints advertised h2 in TLS ALPN but only spoke HTTP/1.1; it now advertises http/1.1 only, matching the cluster's protocol.
XCP Edge now sends its periodic config resync ping to XCP Central on every config-resync-interval tick, instead of skipping the ping whenever central had recently pushed configuration to the edge. Central records the arrival of each ping in xcp_central_last_config_propagation_event_timestamp_ms{type="config_resync_request"}, which is used to report a cluster's last sync time, so clusters receiving frequent configuration updates could report a stale last sync time and spuriously trigger the resync alert while being perfectly healthy.

Outstanding CVEs

The following CVEs have been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations. Where applicable, this was ascertained by using static code analysis tools.

CVE-2026-8763 - No fix available.
CVE-2026-59638 - No fix available.
CVE-2026-42496 - No fix available.
CVE-2026-12087 - No fix available.
CVE-2026-59650 - No fix available.
CVE-2026-5450 - No fix available.
CVE-2026-8376 - No fix available.
CVE-2026-57433 - No fix available.
CVE-2026-58062 - No fix available.
CVE-2026-13221 - No fix available.
CVE-2026-53615 - No fix available.
CVE-2025-8941 - No fix available.
CVE-2026-11979 - No fix available.
CVE-2026-41992 - No fix available.
CVE-2025-69720 - No fix available.
CVE-2026-48959 - No fix available.
CVE-2026-5928 - No fix available.
CVE-2026-42497 - No fix available.
CVE-2026-9538 - No fix available.
CVE-2026-58060 - No fix available.
CVE-2026-11824 - No fix available.
CVE-2026-53492 - No fix available.
CVE-2026-12802 - No fix available.
CVE-2026-33997 - No fix available.
CVE-2026-59644 - No fix available.
CVE-2026-54371 - No fix available.
CVE-2026-59651 - No fix available.
CVE-2026-40356 - No fix available.
CVE-2026-48961 - No fix available.
CVE-2018-20225 - No fix available.
CVE-2026-12860 - No fix available.
CVE-2026-59645 - No fix available.
CVE-2026-14682 - No fix available.
CVE-2026-7017 - No fix available.
CVE-2026-12185 - No fix available.
CVE-2026-59646 - No fix available.
CVE-2026-5435 - No fix available.
CVE-2026-41567 - No fix available.
CVE-2026-59649 - No fix available.
CVE-2026-59639 - No fix available.
CVE-2026-58061 - No fix available.
CVE-2026-59641 - No fix available.
CVE-2026-53489 - No fix available.
CVE-2026-12816 - No fix available.
CVE-2026-11822 - No fix available.
CVE-2026-40355 - No fix available.
PRISMA-2022-0168 - No fix available.
CVE-2026-12803 - No fix available.
CVE-2026-48962 - No fix available.
CVE-2026-54369 - No fix available.
CVE-2026-42306 - No fix available.
CVE-2026-12852 - No fix available.
CVE-2026-59643 - No fix available.
CVE-2026-59642 - No fix available.
CVE-2026-57432 - No fix available.
CVE-2026-59640 - No fix available.
CVE-2026-13506 - No fix available.
CVE-2026-58059 - No fix available.
CVE-2026-12817 - No fix available.
CVE-2026-13757 - No fix available.
CVE-2026-27456 - No fix available.
CVE-2026-35348 - No fix available.
CVE-2026-35354 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2026-3731 - No fix available.
CVE-2026-35351 - No fix available.
CVE-2026-13595 - No fix available.
CVE-2026-10722 - No fix available.
CVE-2026-13586 - No fix available.
CVE-2026-42250 - No fix available.
CVE-2026-27171 - No fix available.
CVE-2026-35377 - No fix available.
CVE-2026-35364 - No fix available.
CVE-2026-35367 - No fix available.
CVE-2026-35359 - No fix available.
CVE-2026-35341 - No fix available.
CVE-2026-6368 - No fix available.
CVE-2026-35350 - No fix available.
CVE-2026-35373 - No fix available.
CVE-2026-35368 - No fix available.
CVE-2026-18477 - No fix available.
CVE-2025-15649 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2026-35374 - No fix available.
CVE-2026-54370 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-50195 - No fix available.
CVE-2026-35344 - No fix available.
CVE-2026-35370 - No fix available.
CVE-2026-15055 - No fix available.
CVE-2026-54411 - No fix available.
CVE-2026-6791 - No fix available.
CVE-2026-59652 - No fix available.
CVE-2026-5704 - No fix available.
CVE-2026-41568 - No fix available.
CVE-2012-2739 - No fix available.
CVE-2026-41991 - No fix available.
CVE-2026-35352 - No fix available.
CVE-2026-6238 - No fix available.
CVE-2026-8484 - No fix available.
CVE-2026-35360 - No fix available.
CVE-2026-7010 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2026-50812 - No fix available.
CVE-2026-58063 - No fix available.
CVE-2026-35357 - No fix available.
CVE-2026-59647 - No fix available.
CVE-2026-18508 - No fix available.
CVE-2026-0990 - No fix available.
CVE-2026-59648 - No fix available.
CVE-2026-35345 - No fix available.
CVE-2026-35371 - No fix available.
CVE-2026-35363 - No fix available.
CVE-2026-50813 - No fix available.
CVE-2012-5373 - No fix available.
CVE-2026-53614 - No fix available.
CVE-2025-70873 - No fix available.
CVE-2025-8732 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2024-56433 - No fix available.
GO-2026-5932 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2026-53613 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2026-53612 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2026-40228 - No fix available.
CVE-2026-56391 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2025-29481 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2026-53910 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2019-1010023 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2025-1352 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2026-56392 - No fix available.
CVE-2026-15534 - No fix available.
CVE-2025-47273 - No fix available.
CVE-2026-23949 - No fix available.
CVE-2026-57585 - No fix available.
CVE-2026-66755 - No fix available.
CVE-2026-30778 - No fix available.

Version 1.12.14

Fixed following CVEs: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-29111, CVE-2026-33186, CVE-2026-33845, CVE-2026-33846, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-3832, CVE-2026-3833, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-40226, CVE-2026-40984, CVE-2026-41178, CVE-2026-41989, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42014, CVE-2026-42015, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, CVE-2026-47244, CVE-2026-47262, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-4878, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5260, CVE-2026-53488, CVE-2026-5419, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-7383, CVE-2026-8643, CVE-2026-9076
Gateway install resources now support configGenerationMetadata, letting you set labels and annotations on the generated GatewayDeployment object. This makes them usable for label-gated behaviors such as OpenAPI spec validation, composer, and gateway upgrade control. Labels and annotations inherited from ancestor tenancy resources (e.g. workspace and gateway group) take precedence on key conflicts.
The Istiod dashboard has been updated with additional panels covering control plane health, connected proxies by version, xDS push pipeline details, mesh state, and Kubernetes config events, providing deeper visibility and richer troubleshooting data for the Istio control plane.
Added metric exclusion controls to the OTel collector for both ControlPlane and ManagementPlane CRs. A default set of high-cardinality metrics (workqueue_work_duration_seconds, workqueue_queue_duration_seconds, controller_runtime_reconcile_time_seconds) is now dropped by default. Users can configure additional exclusions via spec.components.collector.metrics.metricExclusions using exact names or regex patterns, and can opt out of the default exclusions by setting spec.components.collector.metrics.disableDefaultExclusions: true.
Added Prometheus metrics for istioctl manifest generate invocations in the XCP Edge operator: istioctl_invocations_total (counter) and istioctl_invocation_duration_ms (histogram), both labelled by status (success, error, or timeout).
Added a Grafana dashboard XCP Edge Operator (uid xcp-edge-operator) to monitor the gateway upgrade workflow. Its Gateway Upgrades section surfaces installed/ignored/paused/dirty gateway counts, reconcile rate and latency, skipped reconciliations by reason, force-reconcile triggers, and time since last reconcile, all filterable by cluster and gateway namespace.
Corrected the gateway_namespace and gateway_name labels on XCP Edge Operator gateway metrics (e.g. xcp_edge_operator_gateway_reconcile_paused, xcp_edge_operator_gateway_dirty_state, xcp_edge_operator_gateway_reconcile_skipped_total, xcp_edge_operator_last_gateway_reconcile_timestamp_ms) to report the deployed gateway workload's application namespace (the gateway CR's spec.namespace, falling back to metadata.namespace) and source gateway name, instead of the gateway CR's own metadata. This makes the labels match the rendered Deployment/Service and the namespace used for reconciliation overrides.
The XCP Edge /debug/gateway-reconcile-diff admin endpoint now filters by the name and namespace of the actual rendered gateway Deployment, instead of the gateway install CR's own name and namespace. Because the install CR lives in the operator namespace while its Deployment is created in the configured target namespace, the previous namespace filter could match nothing. Each diff entry now also reports deploymentName and deploymentNamespace so the matched Deployment is unambiguous. Note that when in-place gateway upgrade is disabled, the Deployment name carries the revision suffix (e.g. my-gateway-stable), and that exact name must be used when filtering.
Outlier detection settings configured under outbound.upstreamTrafficSettings (including maxEjectionPercent and the other outlierDetection fields) are now applied consistently to sidecar, east-west, multicluster, and Tier1 gateway traffic. In particular, maxEjectionPercent is respected so a service is not fully ejected from load balancing, and outlier detection on Tier1 gateways now reflects the configured values.
Clarified the HTTP retry documentation: when no retry policy is configured, a sensible default is still applied (requests are retried). Automatic retries are turned off only when attempts is set to 0.
Added guidance to the outlierDetection API reference: the enforcing percentages and maxEjectionPercent default to 100, so leaving them unbounded can allow every endpoint of a service to be ejected. Set maxEjectionPercent to keep at least one endpoint in rotation.

Outstanding CVEs

At the time of shipping, there are no Critical and High vulnerabilities flagged. The following CVEs (medium/low) have been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations. Where applicable, this was ascertained by using static code analysis tools.

CVE-2026-42496 - No fix available.
CVE-2026-8376 - No fix available.
CVE-2025-69720 - No fix available.
PRISMA-2022-0168 - No fix available.
CVE-2026-42497 - No fix available.
CVE-2026-9538 - No fix available.
CVE-2026-11824 - No fix available.
CVE-2026-53492 - No fix available.
CVE-2026-41567 - No fix available.
CVE-2026-53489 - No fix available.
CVE-2026-11822 - No fix available.
CVE-2026-48962 - No fix available.
CVE-2026-42306 - No fix available.
CVE-2026-27456 - No fix available.
CVE-2026-35348 - No fix available.
CVE-2026-4046 - No fix available.
CVE-2026-35354 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2026-11856 - No fix available.
CVE-2026-4437 - No fix available.
CVE-2026-5435 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2026-8927 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2026-6238 - No fix available.
CVE-2026-3731 - No fix available.
CVE-2026-35351 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2026-5928 - No fix available.
CVE-2026-8925 - No fix available.
CVE-2026-4438 - No fix available.
CVE-2026-42250 - No fix available.
CVE-2026-9079 - No fix available.
CVE-2026-35377 - No fix available.
CVE-2026-35364 - No fix available.
CVE-2026-35367 - No fix available.
CVE-2026-12087 - No fix available.
CVE-2026-35359 - No fix available.
CVE-2026-35341 - No fix available.
CVE-2026-35350 - No fix available.
CVE-2026-5450 - No fix available.
CVE-2026-35373 - No fix available.
CVE-2026-35368 - No fix available.
CVE-2026-48961 - No fix available.
CVE-2025-15649 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2026-35374 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-50195 - No fix available.
CVE-2026-35344 - No fix available.
CVE-2026-35370 - No fix available.
CVE-2026-54411 - No fix available.
CVE-2026-5704 - No fix available.
CVE-2026-48959 - No fix available.
CVE-2026-35352 - No fix available.
CVE-2026-27171 - No fix available.
CVE-2026-35360 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2026-7010 - No fix available.
CVE-2026-34743 - No fix available.
CVE-2026-35357 - No fix available.
CVE-2026-35345 - No fix available.
CVE-2026-35371 - No fix available.
CVE-2026-35363 - No fix available.
CVE-2026-41568 - No fix available.
CVE-2026-8924 - No fix available.
CVE-2026-53614 - No fix available.
CVE-2026-8932 - No fix available.
CVE-2026-53615 - No fix available.
CVE-2025-70873 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2026-10536 - No fix available.
CVE-2026-8286 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2026-9545 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2026-53613 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2026-9546 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2026-9080 - No fix available.
CVE-2026-53612 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2026-11586 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2026-9547 - No fix available.
CVE-2026-11352 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2026-8458 - No fix available.
CVE-2026-12064 - No fix available.
CVE-2026-40228 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2026-8926 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2019-1010022 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2026-11564 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2019-1010023 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2025-1352 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2025-29481 - No fix available.

Version 1.12.13

Fixed CVE-2026-33845, CVE-2026-33846, CVE-2026-3832, CVE-2026-3833, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42014, CVE-2026-42015, CVE-2026-46680, CVE-2026-5260, CVE-2026-5419, CVE-2026-7598.
Fixed CVE-2026-49975 and CVE-2026-47774 which are critical Denial of Service (DoS) vulnerabilities affecting default HTTP/2 protocol implementation in envoyproxy, broadly known as the HTTP/2 Bomb.
Added Helm-style --set, --set-string, --set-file, and --values/-f flags to tctl install manifest cluster-install-template to override or supplement the values returned by the cluster install template.

Outstanding CVEs

CVE-2026-42496 - No fix available.
CVE-2026-8376 - No fix available.
CVE-2025-69720 - No fix available.
CVE-2026-42497 - No fix available.
CVE-2026-9538 - No fix available.
CVE-2026-41567 - No fix available.
PRISMA-2022-0168 - No fix available.
CVE-2026-48962 - No fix available.
CVE-2026-42306 - No fix available.
CVE-2026-27456 - No fix available.
CVE-2026-35348 - No fix available.
CVE-2026-4046 - No fix available.
CVE-2026-35354 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2026-4437 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2026-6238 - No fix available.
CVE-2026-5435 - No fix available.
CVE-2026-35351 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2026-4438 - No fix available.
CVE-2026-35377 - No fix available.
CVE-2026-35364 - No fix available.
CVE-2026-5450 - No fix available.
CVE-2026-35367 - No fix available.
CVE-2026-35359 - No fix available.
CVE-2026-35341 - No fix available.
CVE-2026-35350 - No fix available.
CVE-2026-35373 - No fix available.
CVE-2026-35368 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2026-5928 - No fix available.
CVE-2026-35374 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-35344 - No fix available.
CVE-2026-35370 - No fix available.
CVE-2026-5704 - No fix available.
CVE-2026-35352 - No fix available.
CVE-2026-27171 - No fix available.
CVE-2026-35360 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2026-34743 - No fix available.
CVE-2026-35357 - No fix available.
CVE-2026-35345 - No fix available.
CVE-2026-35371 - No fix available.
CVE-2026-35363 - No fix available.
CVE-2026-41568 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2026-42250 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2025-70873 - No fix available.
CVE-2019-9192 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2026-40228 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2026-7010 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2025-15649 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2024-2236 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2026-48959 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2026-48961 - No fix available.
CVE-2025-29481 - No fix available.
CVE-2019-1010025 - No fix available.

Version 1.12.12

Fixed the following CVEs: CVE-2024-58251,CVE-2025-15281,CVE-2025-22872,CVE-2025-46394,CVE-2025-47907,CVE-2025-58185,CVE-2025-58187,CVE-2025-58188,CVE-2025-58189,CVE-2025-60876,CVE-2025-61723,CVE-2025-61725,CVE-2025-61726,CVE-2025-61729,CVE-2025-68121,CVE-2025-68156,CVE-2026-0861,CVE-2026-0915,CVE-2026-0994,CVE-2026-22007,CVE-2026-22013,CVE-2026-22016,CVE-2026-22018,CVE-2026-22021,CVE-2026-22184,CVE-2026-24051,CVE-2026-25679,CVE-2026-2673,CVE-2026-27135,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-29111,CVE-2026-29181,CVE-2026-30778,CVE-2026-31789,CVE-2026-31790,CVE-2026-32280,CVE-2026-32281,CVE-2026-32282,CVE-2026-32283,CVE-2026-32287,CVE-2026-32288,CVE-2026-32289,CVE-2026-32952,CVE-2026-33186,CVE-2026-33230,CVE-2026-33810,CVE-2026-33811,CVE-2026-33814,CVE-2026-33815,CVE-2026-33816,CVE-2026-33870,CVE-2026-33871,CVE-2026-33997,CVE-2026-34040,CVE-2026-34268,CVE-2026-34282,CVE-2026-34477,CVE-2026-34480,CVE-2026-34986,CVE-2026-35206,CVE-2026-35469,CVE-2026-39820,CVE-2026-39823,CVE-2026-39825,CVE-2026-39826,CVE-2026-39836,CVE-2026-39882,CVE-2026-39883,CVE-2026-40179,CVE-2026-40200,CVE-2026-40225,CVE-2026-40226,CVE-2026-4105,CVE-2026-41417,CVE-2026-42151,CVE-2026-42154,CVE-2026-42499,CVE-2026-42577,CVE-2026-42578,CVE-2026-42579,CVE-2026-42580,CVE-2026-42581,CVE-2026-42583,CVE-2026-42584,CVE-2026-42585,CVE-2026-44903,CVE-2026-4539,CVE-2026-4873,CVE-2026-4878,CVE-2026-5545,CVE-2026-5773,CVE-2026-5958,CVE-2026-6042,CVE-2026-6253,CVE-2026-6276,CVE-2026-6357,CVE-2026-6429,CVE-2026-6472,CVE-2026-6473,CVE-2026-6474,CVE-2026-6475,CVE-2026-6477,CVE-2026-6478,CVE-2026-6479,CVE-2026-6637,CVE-2026-6732,CVE-2026-7168,GHSA-fw8g-cg8f-9j28,GHSA-j88v-2chj-qfwx, CVE-2026-22184.
Fixed duplicate host validation for gateways so that conflicting host/port combinations are detected when one gateway's workload selector is a superset of another's, not only when it is a subset. Previously, two gateways in the same group sharing a host/port could pass validation if their label selectors overlapped only in the superset direction.
The control plane webhook port is now configurable via the operator.webhookPort Helm value (default: 9443). For example:
```
operator:
  webhookPort: 9444
```
Temurin 11 JRE to the latest patched build (April 2026 Oracle CPU).
Added DISABLE_SEGMENTATION environment variable on the TSB operator to control deployment of the N2AC (segmentation) component. When set to true, the operator skips deploying N2AC and sets TSB_DISABLE_SEGMENTATION=true on the bridge and web-ui deployments. Previously, N2AC was always deployed regardless of whether segmentation was enabled.
Fixed a panic in MPC that caused a CrashLoopBackOff when Flagger was installed in the cluster. The canaries.flagger.app CRD triggered an informer whose list function called into a nil Flagger client. MPC now initializes a real Flagger client at startup and passes it to the combined kube client, preventing the nil-pointer dereference.
Fix a high cpu consumption issue when the --configwatch-service-account-debounce-interval=0s flag was set in the apiserver.
TSB now creates a dedicated promql user with a configurable password to access the /promql endpoint. The user is unprivileged in the scope of TSB permissions. To configure it, use the --tsb-promql-password flag with tctl install manifest management-plane or set the secrets.tsb.promqlPassword Helm value when installing the Management Plane chart. The password is stored in the admin-credentials Kubernetes Secret under the promql key in namespace tsb.
The busybox image has been removed from the TSB release. This image has been replaced with an smaller internal one holding only the necessary capabilities.
Fixed Azure base group lookup in TeamSync to require an exact displayName match. Microsoft Graph search returns groups whose names contain the query string, so configuring a base group like HR could previously resolve to a different group such as HR Taskforce. TeamSync now filters search results to the exact display name and fails fast with a clear error if no group matches.
Fixes issues where XCP resources wouldn't update correctly. All resources created by the XCP operators now use server side apply instead of merge, and can be reverted to the old behavior by setting USE_SERVER_SIDE_APPLY to false on the XCP operator deployments.
Added a dry-run diff endpoint (/debug/gateway-reconcile-diff) on the edge operator admin server (port 8090) to preview what changes would be applied when reconciliation is resumed. The response shows per-gateway reconciliation state, pending changes to Deployments/Services/ServiceAccounts/HPAs, whether changes would cause pod restarts, and a unified YAML diff. The response summary includes total gateways, count with changes, count that will cause restarts, and count paused.
Gateway deployment config status now reports the RECONCILIATION_PAUSED phase as APPLIED_NOT_READY, with a ReconciliationPaused condition indicating the pause reason. The status includes current workload details (deployment readiness, replica counts, service type).
Gateway install objects (IngressDeployment, EgressDeployment, Tier1Deployment, GatewayDeployment) are now protected from accidental deletion. Deletion of managed gateway CRs is blocked when edge deletion protection is enabled. Non-managed gateway CRs are not affected.
Added two new metrics for gateway reconciliation observability:
- gateway_reconcile_paused (gauge, labels: gateway_type, gateway_namespace, gateway_name): reports per-gateway pause state (1 = paused, 0 = active).
- gateway_reconcile_skipped_total (counter, labels: gateway_type, reason, gateway_namespace, gateway_name): tracks the number of reconciliations skipped, with reason indicating the level that disabled it (object_label_disabled, namespace_api_disabled, revision_api_disabled).
Gateway deployments are no longer reconciled during upgrades when their spec hasn't changed. A new RECONCILIATION_DIRTY phase and DirtyStateDetected condition surface when the generated config would differ from what's applied, giving visibility into configuration drift. Users can force reconciliation by setting the install.tetrate.io/reconcile-before label with a future date.
Added a new feature to the XCP Edge operator that allows users to override the proxy configuration annotation proxy.istio.io/config for the gateway deployments.
Tier1 gateways now validate that the TrafficGroup and SecurityGroup are consistent across clusters.
Fixed an issue where shared components (CNI, OAP, meshExpansion) could be inconsistently assigned to different revisions across restarts or upgrades. The default revision is now always preferred when available, ensuring stable and predictable behavior in multi-revision deployments.
Fixed accumulation of additionalOverlays which caused stale values to exist even after they were removed from EdgeXcp.
Fixed the status poller for GatewayDeployments which showed pending status for all gateways in the tsb namespace.
XCP operator now automatically skips wasmfetcher custom templates when native sidecars are enabled. With native sidecars (Istio >= 1.27 default), the wasmfetcher init container approach is unnecessary. Detection uses a three-layer approach: the SKIP_WASMFETCHER_CUSTOM_TEMPLATES operator env var override, explicit ENABLE_NATIVE_SIDECARS in EdgeXcp istiod env, and Istio version-based auto-detection (>= 1.27).
Added configurable metric cardinality control for XCP Edge. The following high-cardinality per-namespace metrics are suppressed by default to prevent Prometheus storage growth in large clusters:
- xcp_edge_cr_apply_time_in_ms
- xcp_edge_k8s_configs_apply_time_secs
- xcp_edge_istio_object_missing_hash_annotation_count
The active filtering rules are written to the edge-config ConfigMap on every reconcile, making them discoverable via kubectl get configmap edge-config -o yaml.

Operators can customise the rules via spec.metrics.metricExclusions on the EdgeXcp CR. Each entry specifies a metric name matcher (exact string or RE2 regular expression). A matching metric family is fully suppressed at scrape time.

To disable all built-in defaults and emit every metric unfiltered, set spec.metrics.disableDefaultExclusions: true.
Fixed OpenShift HCP/HyperShift cluster detection. Worker nodes on hosted control plane clusters lack the machineconfiguration.openshift.io/state annotation (managed by the MachineConfig Operator on the management cluster), causing them to be detected as unknown provider. Detection now falls back to the hypershift.openshift.io/managed label for HCP worker nodes, and the node.openshift.io/os_id label as a general OpenShift catch-all.
Removed a debug log from xcpd that would include authorization tokens in central when new connections were established. This log was only emitted when logging was set to the debug level.

Outstanding CVEs

CVE-2025-69720 - No fix available.
CVE-2026-27456 - No fix available.
CVE-2026-4046 - No fix available.
CVE-2026-4437 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2026-4438 - No fix available.
CVE-2026-5450 - No fix available.
CVE-2026-6238 - No fix available.
CVE-2026-5435 - No fix available.
CVE-2026-5928 - No fix available.
CVE-2026-5704 - No fix available.
CVE-2026-27171 - No fix available.
CVE-2026-34743 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2026-40228 - No fix available.

Version 1.12.11

Fixed CVE-2026-33186.
Fixed an issue where removing IstioOperator overlays (e.g. proxyStatsMatcher) did not take effect because the previous JSON merge patch preserved stale fields. IstioOperator CR updates now use server-side apply, and can be reverted to the old behavior by setting USE_SERVER_SIDE_APPLY_FOR_IOP to false on the XCP edge operator deployment.
At gateways, fix duplication of authentication configuration across hostnames and optimize memory consumption. From previous releases which have ENABLE_JWT_AUTHENTICATION_MANDATORY_JWT_TOKEN, the env variable must be replaced with ENABLE_ENHANCED_REQUEST_AUTHENTICATION, which is a superset of functionality previously put behind ENABLE_JWT_AUTHENTICATION_MANDATORY_JWT_TOKEN.

Outstanding CVEs

CVE-2025-69720 - No fix available.
CVE-2026-4046 - No fix available.
CVE-2026-29111 - No fix available.
CVE-2026-33231 - No fix available.
PRISMA-2022-0168 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2026-4437 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2026-4438 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-4105 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010022 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2025-70873 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2024-2236 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2026-2673 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2018-20796 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2019-1010025 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2026-34743 - No fix available.
CVE-2025-29481 - No fix available.

Version 1.12.10

Fixed the following CVEs: CVE-2025-69421,CVE-2024-22365,CVE-2025-68973,CVE-2025-69420,CVE-2025-9820,CVE-2026-22796,CVE-2025-69418,CVE-2025-15467,CVE-2025-68160,CVE-2025-69419,CVE-2025-14831,CVE-2025-6020,CVE-2026-22795,CVE-2025-61730,CVE-2025-61726,CVE-2026-24051,CVE-2026-27139,CVE-2025-68121,CVE-2025-58181,GO-2026-4342,CVE-2026-27142,CVE-2025-61728,CVE-2026-25679,CVE-2026-33186,GHSA-jqcq-xjh3-6g23 / CVE-2026-4427,CVE-2026-27137,CVE-2026-27171,CVE-2025-60876,CVE-2026-22184,GHSA-72hv-8253-57qq,CVE-2025-15281,GHSA-jqcq-xjh3-6g23,CVE-2025-47914,CVE-2025-61729,CVE-2025-61731,CVE-2025-68119,CVE-2025-58183, CVE-2025-68156,CVE-2025-47907,CVE-2026-22695,CVE-2025-13151,CVE-2026-0861,CVE-2026-0915,CVE-2026-2219,CVE-2025-7709,CVE-2026-1965,CVE-2026-3783,CVE-2026-3731,CVE-2026-23865,CVE-2025-59530
Fixed an issue where XCP Edge would update some ServiceEntry, DestinationRule and AuthorizationPolicy resources repeatedly with different field ordering. This could cause unnecessary CPU usage and API server load.
Added support for ISTIO_MUTUAL mode for external authorization.
Add support for timeout and cors policy in HTTP route rules.
When moving from releases below TSB 1.12 to 1.12+, it is recommended to delete the istio-revision-tag-default mutating webhook from the cluster post upgrade. Please use kubectl delete mutatingwebhookconfiguration istio-revision-tag-default command for the same. When upgraded from below 1.12 to 1.12, stale istio-revision-tag-default MutatingWebhookConfiguration is automatically removed at startup. This webhook was previously managed by istio-operator and is no longer needed, as it caused the admission webhook to run twice with conflicting results.
Upgrade Note: From previous releases which have ENABLE_JWT_AUTHENTICATION_MANDATORY_JWT_TOKEN, the env variable must be replaced with ENABLE_ENHANCED_REQUEST_AUTHENTICATION, which is a superset of functionality previously put behind ENABLE_JWT_AUTHENTICATION_MANDATORY_JWT_TOKEN. New improved bevaviour additionally, at gateways, fixes duplication of authentication configuration across hostnames and optimize memory consumption.

Outstanding CVEs

CVE-2025-69720 - No fix available.
CVE-2026-4046 - No fix available.
CVE-2026-29111 - No fix available.
CVE-2026-33231 - No fix available.
PRISMA-2022-0168 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2026-4437 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2026-4438 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-4105 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010022 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2025-70873 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2024-2236 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2026-3184 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2026-2673 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2018-20796 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2019-1010025 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2026-34743 - No fix available.
CVE-2025-29481 - No fix available.

Version 1.12.9

Fixed the following CVEs: CVE-2025-15467, CVE-2025-69419, CVE-2025-69420, CVE-2026-22795, CVE-2025-69418, CVE-2026-22796, CVE-2025-68160, CVE-2025-69421, CVE-2026-0861.
Performance improvements when retrieving data for topology visualizaton.
Fix to UI when rendering teams with circular dependencies.
Add requireJwt option in Authentication settings, mandating that a request must have a JWT token. Without this option, an Authorization setting is also required to block requests without JWT tokens.
Resolve issue where the removal of pod annotations would not be propagated when Gateway resources were updated.
Fix data race when generating gateway resources that in rare cases could cause gateway restarts or incorrect values to be used.
Fix race condition with cluster state reads
Allow setting perTryTimeout in HTTP retry settings even when retries are disabled (attempts set to 0). This enables configuring request timeouts without enabling automatic retries.
Propagate validation errors from edge when configs not applied
Port validation is added at Host level on Gateway
Send diagnostic error message at workspace level when no istio configs are applied due to validation error.
Add metrics and dashboard panels for various components.

New metrics in XCP Central Operator:

xcp_operator_central_feature_enabled
xcp_operator_central_feature_value
xcp_operator_central_feature_value_seconds
xcp_operator_central_feature_value_string

New metrics in XCP Edge Operator:

xcp_operator_edge_feature_enabled
xcp_operator_edge_feature_value
xcp_operator_edge_feature_value_seconds
xcp_operator_edge_feature_value_string

New metrics in XCP Central:

xcp_central_config_status_server_streams_total
xcp_central_config_status_server_streams_open_count
xcp_central_aggregate_config_status_server_streams_total
xcp_central_aggregate_config_status_server_streams_open_count
xcp_central_resource_exchange_server_streams_total
xcp_central_resource_exchange_server_streams_open_count
xcp_central_cluster_state_server_streams_total
xcp_central_cluster_state_server_streams_open_count

New metrics in XCP Edge:

xcp_edge_config_status_client_streams_total
xcp_edge_config_status_client_streams_open_count
xcp_edge_resource_exchange_client_streams_total
xcp_edge_resource_exchange_client_streams_open_count
xcp_edge_cluster_state_client_streams_total
xcp_edge_cluster_state_client_streams_open_count
xcp_edge_config_translation_attempts_total
xcp_edge_config_translation_attempts_failed_total
xcp_edge_unmanaged_resources_count
Changed name and type of certain metrics to adhere to Prometheus conventions.

Affected metrics:

diagnostic_channel_client_up_total (counter) -> diagnostic_channel_client_up (gauge)
diagnostic_channel_client_open_channel_websocket_connections_active_count_total (counter) -> diagnostic_channel_client_open_channel_websocket_connections_active_count (gauge)
diagnostic_channel_server_up_total (counter) -> diagnostic_channel_server_up (gauge)
diagnostic_channel_server_open_channel_requests_active_count_total (counter) -> diagnostic_channel_server_open_channel_requests_active_count (gauge)
diagnostic_channel_server_open_channel_websocket_connections_active_count_total (counter) -> diagnostic_channel_server_open_channel_websocket_connections_active_count (gauge)
diagnostic_service_up_total (counter) -> diagnostic_service_up (gauge)
diagnostic_service_execute_task_running_count_total (counter) -> diagnostic_service_execute_task_running_count (gauge)
diagnostic_service_stream_task_running_count_total (counter) -> diagnostic_service_stream_task_running_count (gauge)
dns_resolution_cache_domain_names_watched_count_total (counter) -> dns_resolution_cache_domain_names_watched_count (gauge)
dns_resolution_cache_domain_names_unresolved_count_total (counter) -> dns_resolution_cache_domain_names_unresolved_count (gauge)
ha_cross_partition_requestor_relay_client_streams_open_count_total (counter) -> ha_cross_partition_requestor_relay_client_streams_open_count (gauge)
ha_cross_partition_responder_relay_server_streams_open_count_total (counter) -> ha_cross_partition_responder_relay_server_streams_open_count (gauge)
ha_secondary_relay_client_streams_open_count_total (counter) -> ha_secondary_relay_client_streams_open_count (gauge)
ha_primary_relay_server_streams_open_count_total (counter) -> ha_primary_relay_server_streams_open_count (gauge)
current_onboarded_edge_total (counter) -> current_onboarded_edge_total (gauge)
xcp_central_pending_configs_total (counter) -> xcp_central_pending_configs_total (gauge)
xcp_central_pending_on_ref_configs_total (counter) -> xcp_central_pending_on_ref_configs_total (gauge)
Fixed gateway deployments appearing to restart during TSB upgrades when HPA is enabled. Previously, during upgrades, the operator would apply deployment manifests with replicaCount: 1 (the default), temporarily scaling down HPA-managed gateways before HPA scaled them back up. Now, when an HPA exists for a gateway deployment, the operator omits updating replica count, preserving the HPA-managed replica count and preventing unnecessary pod restarts.
Fixed OIDC authentication to respect user-defined authScopes configuration. Previously, only the openid scope was being set, ignoring any custom scopes specified.
Set ISTIO_PROXY_READINESS_PROBE_TIMEOUT (Custom Timeout added to Tetrate Istio for scale) to 10s for edge gateways.
Enable optional metrics in Istio.

Enabled metrics in istiod:

pilot_worker_queue_depth
pilot_worker_queue_latency
pilot_worker_queue_duration
pilot_envoy_filter_status
xds_cache_reads
xds_cache_evictions
xds_cache_size
xds_cache_dependent_config_size

New metrics in XCP Central:

xcp_central_pilot_worker_queue_depth
xcp_central_pilot_worker_queue_latency
xcp_central_pilot_worker_queue_duration

New metrics in XCP Edge:

xcp_edge_pilot_worker_queue_depth
xcp_edge_pilot_worker_queue_latency
xcp_edge_pilot_worker_queue_duration
Fixed a data race causing central restarts and was mitigated by setting ENABLE_INVALIDATE_CONFIG_STATUS_CACHE_ON_ADMISSION: false.
Fixed an issue where gateway pod annotations were not updated correctly. Gateway Deployment updates now use server side apply instead of merge, and can be reverted to the old behavior by setting USE_SERVER_SIDE_APPLY_FOR_GATEWAY_DEPLOYMENTS to false on the XCP edge operator deployment.

Outstanding CVEs

PRISMA-2022-0168 - No fix available.
CVE-2025-8941 - No fix available.
CVE-2025-66382 - No fix available.
CVE-2025-14104 - No fix available.
CVE-2025-15281 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-68972 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2025-7709 - No fix available.
CVE-2026-22185 - No fix available.
CVE-2026-0915 - No fix available.
CVE-2024-52005 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2025-14524 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2025-14819 - No fix available.
CVE-2025-9086 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2025-15079 - No fix available.
CVE-2019-20838 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2025-15224 - No fix available.
CVE-2025-1376 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2007-5686 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2025-10148 - No fix available.
CVE-2022-0563 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2023-31439 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2021-45346 - No fix available.
CVE-2019-1010024 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2017-18018 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2017-11164 - No fix available.
CVE-2025-29481 - No fix available.

Version 1.12.8

Fixed the following CVEs: CVE-2025-22872, CVE-2025-61727, GO-2025-4155, CVE-2024-25621, CVE-2025-64329, CVE-2025-47914, CVE-2025-58181, CVE-2024-58251, CVE-2025-46394, CVE-2025-58187, CVE-2025-58183, CVE-2025-47912, CVE-2025-58186, CVE-2025-58188, CVE-2025-61723, CVE-2025-61724, CVE-2025-58189, CVE-2025-61725, CVE-2025-58185, CVE-2025-11579, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-8058, CVE-2025-58058, CVE-2025-55199, CVE-2025-47907.
Configured the Istiod env ISTIO_GPRC_MAXRECVMSGSIZE to 20 MiB as large customers were seeing the xds size limit being reached in 1.12.
Optimized cluster state updates from control plane clusters. Only gateway pod restarts now trigger full cluster state updates, reducing load on the management plane for large installations with many control planes.
A minor fix for gateway metrics in the UI by adding label version to gateway deployments.
Bug fix in configuring mesh timeout settings via TrafficSettings API by removing an incorrect requirement of istio mtls.
Internal change to coordinate supported minor/release releases during releases through configmap. Configmap name is xcp-releases. After upgrade verify that current xcp release version is updated in the configmap.
Openshift installation: fixed an issue where existing k8s gateway CRDs were resulting in failure to install TSB control plane.
xcp central Fix to re-init central’s watcher connection to k8s apiserver. XCP_CENTRAL_K8S_API_SERVER_IDLE_TIMEOUT env can be set to customize the timeout duration. Default is 10 minutes. config_controller_restarts_total metric can be used to monitor the number of restarts.
Fix in the service entry generation logic for the hostnames which differ only by . or -, ex: bookinfo.tetrate.com and bookinfo-tetrate.com. After fix, there will be separate SEs for both.
Default value of MAX_CONCURRENT_GATEWAY_RECONCILES on xcp-operator-edge deployment is set to 1 to avoid potential race issues during gateway reconciliation.
Fix in Workload entry generation for hosts exposed on tier2 gateways for issue which happens if there are duplicate hostnames on two different gateways in the same cluster.
Authorization api enhancement to support timeout to control how long the proxy waits for the external authorization backend to respond.
Fixed issue: Delete a cluster now unregisters its services from the service registry.
GitOps reconciliation improved: so when a TSB Group config is applied, if the parent workspace was in a failing state its reconciliation is triggered now. This helps solve issues like adding new namespace selectors in workspaces and groups at once.
Fixed a validation issue for ManagementPlane and ControlPlane CRs on K8s versions >= 1.30, which was failing due to an invalid spec.validation field.
Feature enhancement: TSB Config Status now provides ACCEPTED_COMPOSED and READY_COMPOSED for configs that are a result of profiles and legacy settings (like tenant or workspace settings)
TSB self-observability dashboards now accept a datasource ID when they are imported or generated. Example command tctl x grafana upload --datasource-uid <uid>.

Outstanding CVEs

PRISMA-2021-0153 - No fix available.
CVE-2025-22227 - No fix available.
CVE-2025-37727 - No fix available.
CVE-2025-4673 - No fix available.
CVE-2025-29481 - No fix available.
CVE-2025-66221 - No fix available.
CVE-2025-47906 - No fix available.
CVE-2025-54388 - No fix available.
CVE-2025-8058 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2013-4392 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2011-4116 - No fix available.

Version 1.12.7

Fixed the following CVEs: CVE-2025-62409, CVE-2025-62504, CVE-2025-47907, CVE-2025-22869, CVE-2025-22868, CVE-2025-0913, CVE-2025-4673, CVE-2025-47906, CVE-2025-22872, CVE-2025-22871, CVE-2025-22870, CVE-2025-8058, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-8715, CVE-2025-8714, CVE-2025-4207, CVE-2025-8713, CVE-2025-58058, CVE-2025-55199, CVE-2025-4802, CVE-2025-54388.
Fixed config status reporting issue, where a change that reverted back to a previous state was sometimes not reported, resulting in incorrect status. Note: this fix may report occasional duplicate events
Replaced OpenCensus with Otel for metrics transfer from controlplane to management plane. Important: Please refer to Upgrade instructions in documentation
Improved error detection when generating PostGres backups
Resolved issue with large ( > 64Kb ) Istio ConfigMaps

Outstanding CVEs

CVE-2024-10963 - No fix available.
CVE-2025-7709 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2025-11579 - No fix available.
CVE-2024-52005 - No fix available.
GO-2025-3900 - No fix available.
CVE-2023-42365 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2025-30698 - No fix available.
CVE-2025-9086 - No fix available.
CVE-2025-8114 - No fix available.
CVE-2025-6297 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2025-10148 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2025-46394 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2025-21587 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2011-4116 - No fix available.

Version 1.12.6

Fixed the following CVEs: CVE-2025-54988, CVE-2025-48924, CVE-2025-47907, CVE-2025-55163, CVE-2025-22868, CVE-2025-22874, CVE-2025-22871, CVE-2025-22872, CVE-2025-4673, CVE-2025-0913.
Fixes an issue where the IAM component required a restart for Control Plane clusters to report their status. IAM now automatically updates by subscribing to TSB Service Account events.

Outstanding CVEs

CVE-2025-4802 - No fix available.
PRISMA-2022-0168 - No fix available.
CVE-2025-46835 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2025-40909 - No fix available.
CVE-2025-8885 - No fix available.
CVE-2025-0913 - No fix available.
CVE-2025-32989 - No fix available.
CVE-2023-42363 - No fix available.
CVE-2025-4673 - No fix available.
CVE-2025-5702 - No fix available.
CVE-2025-27613 - No fix available.
CVE-2023-42366 - No fix available.
CVE-2025-8916 - No fix available.
CVE-2025-32988 - No fix available.
CVE-2023-42364 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2025-30698 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2025-30691 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2025-58050 - No fix available.
CVE-2019-20838 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2025-21587 - No fix available.
CVE-2023-31438 - No fix available.

Version 1.12.5

Fixed CVE-2025-29914, CVE-2025-22874, CVE-2025-0913, CVE-2025-4673, CVE-2025-31672, GHSA-fv92-fjc5-jj9h, CVE-2025-4598, CVE-2024-26462, CVE-2023-4641, CVE-2024-12243, CVE-2025-0395, CVE-2024-6602, CVE-2025-1390, CVE-2025-24528, CVE-2024-12133, CVE-2024-5535, CVE-2024-13176, CVE-2025-5222, CVE-2025-22871, CVE-2025-22872, CVE-2025-5222, CVE-2025-53547.
- As part of the fix for CVE-2025-29914, the WAF image has been updated to include Coraza WAF v3.3.3 and CRS v4.14.0. If you need to use a custom WAF image, you can do so via a WASM extension resource.
Fixed HTTP/2 issue between OAP service and ElasticSearch.
Added metrics for the embedded PostgreSQL service for easier monitoring of this service.
Improved generation of Management Plane UI authentication cookie to address a possible security issue.
Fixed validation bug that prevented certain configurations for Tier-2 (App) gateways.
Fixed CNI IOP conflict with Install IOP, which prevented installation under certain circumstances on OpenShift.
Fixed bug in configuration profile merging with 0-values in keys. Note: this fix changed the protobuf definition of the API, making breaking changes in some languages like Go, due to some scalar fields being updated to use pointers to correctly distinguish between unset and zero values.
Fixed bug where authorization service accounts might not be correctly scoped to clusters.
Moved internal service registry sync to react to cluster changes instead of being a periodic task to improve performance. This deprecates the flag registry-interval of the API server component.
Fixed how authorization policies in CUSTOM mode with allowed service accounts are restricted to parent target clusters. Now the service accounts are converted into fully qualified 3-part IDs tied to each targeted cluster in parent rules, instead of all the known onboarded clusters.
Fixed an issue where stricter propagation settings in security settings didn’t propagate the traffic mode. Additionally, this update has improved the compatibility of profiles with the security settings.
Fixed an issue with the configuration status for the install gateways. Some state changes related to the replica count were overlooked.
Fixed an issue where the API server wouldn’t boot if segmentation was previously used.

UI

Added a new Health tab to the workspace detail page, providing a more consistent and reliable view of service metrics. The data shown in tables and charts is now fetched in a more efficient way, improving performance and ensuring the same values are displayed across different parts of TSB UI.
Service Topology view for Ambient Clusters was enhanced to allow the user to view the graph with or without Waypoints and with ambient objects annotated.

Outstanding CVEs

CVE-2023-45853 - No fix available.
CVE-2025-4802 - No fix available.
CVE-2025-6020 - No fix available.
CVE-2025-6965 - No fix available.
PRISMA-2022-0168 - No fix available.
CVE-2023-31484 - No fix available.
CVE-2024-22365 - No fix available.
CVE-2024-10041 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-45582 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2025-40909 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2024-52005 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2025-29481 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2016-20013 - No fix available.
CVE-2025-6141 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2013-4392 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2011-3374 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2019-20838 - No fix available.
CVE-2023-31437 - No fix available.
CVE-2023-31486 - No fix available.
CVE-2025-27587 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2022-0563 - No fix available.
TEMP-0290435-0B57B5 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2025-30258 - No fix available.
TEMP-0517018-A83CE6 - No fix available.
CVE-2011-3389 - No fix available.
CVE-2013-4235 - No fix available.
CVE-2022-27943 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2025-6297 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2025-5278 - No fix available.
CVE-2005-2541 - No fix available.
CVE-2018-6829 - No fix available.
CVE-2023-31438 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2023-31439 - No fix available.
CVE-2007-5686 - No fix available.
CVE-2023-26604 - No fix available.
TEMP-0628843-DBAD28 - No fix available.
CVE-2021-45346 - No fix available.
TEMP-0841856-B18BAF - No fix available.
CVE-2017-18018 - No fix available.
CVE-2017-11164 - No fix available.
CVE-2011-4116 - No fix available.
CVE-2022-41409 - No fix available.

Version 1.12.4

Fixed CVE-2024-13176, CVE-2025-32414, CVE-2025-32415, CVE-2025-32386, CVE-2025-30153, CVE-2025-22871, CVE-2025-22872, CVE-2024-45341, CVE-2024-45336, CVE-2025-0395, CVE-2025-22866.
TSB operator performance improvements: reduced resource usage of the management and control plane operators, reduced the Kubernetes resources being watched, and reconfigured the Istio gitops webhooks to only capture the TSB related resources.
Fixed OAP can not disable metrics.
Fixed a bug with deletion protection webhook caBundle getting overwritten by kube-api server.
Add support for transitioning from control plane managed gateway installs to management plane managed gateway installs.
Added path_prefix in external authorization configuration. This option allows prefixing a external authz call with a supplied path.
Added allowed_upstream_headers in external authorization configuration. This option allows sending response headers from external authz response to upstream.
Added support for discovering Kubernetes Gateway in OBSERVE mode.
Enhanced HTTP ratelimit to be only called for configured hostnames on shared gateways.
Fixed an issue that caused infinite reconciliation of registered services containing dots in the name.
Fixed an issue that didn't update the segmentation internal runtime state with cluster updates.
Improved the configuration propagation time from the Database to the XCP component.
Optimized the memory usage of the TSB operator when gitops is enabled.
Fixed the tctl x app-ingress command to run with Istio 1.24.5.
Added support to annotate Organization, Clusters, Tenants, Workspaces, and Groups resources with segmentation membership by using it like segmentation.tetrate.io/membership: policyA/zone1,policyA/zone2.

Outstanding CVEs

PRISMA-2022-0168 - No fix available.
CVE-2025-4598 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2025-3576 - No fix available.
CVE-2025-31672 - No fix available.
CVE-2025-29481 - No fix available.
CVE-2025-46836 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2025-30698 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2025-5745 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2023-29383 - No fix available.
CVE-2023-31484 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2025-40909 - No fix available.
CVE-2025-30258 - No fix available.
CVE-2024-22365 - No fix available.
CVE-2023-26604 - No fix available.
CVE-2022-41409 - No fix available.
CVE-2025-1390 - No fix available.

Version 1.12.3

Fixed CVE-2025-22870, CVE-2025-22872, CVE-2025-22869, CVE-2025-30204, CVE-2025-32386, CVE-2025-32387, CVE-2024-40635, CVE-2025-22870.
Added capability to failback after a Management Plane failover
Enable mountInternalWasmExtensions and identityPropagation by default in Ambient mode.
Fix service state reporting in Ambient mode by XCP Edge.
Fix metadata exchange filter configuration for Ambient mode with ISB enabled.
Stop aligning trust domains for service reported by XCP in Service registry.
Fix status reporting in TSB Operator for Onboarding components.
Fix workload listing in Proxy tools for non-injection namespaces.
Improve OAP PromQL Service: Querying Metadata(traffic) supports result number limit and filter by regex match.
Enhance the installation gateway resource configuration status reporting by providing detailed information about the deployment and service associated with the installed gateway.
Enhanced custom OutlierDetection settings in TrafficSettings by adding configuration capability for maxEjectionTime and maxEjectionPercent.
Improve the config status search by FQDN to include redirects, subsets, and ports matching analysis.
Embedded Postgres: Fix an upgrade issue where replicas before 1.12.0 didn't properly upgrade connection details to the primary node using TLS.
Embedded Postgres: Remove Postgres noisy logs about no TLS-secured connections caused by the k8s health check. It now uses TLS certs.
Embedded Postgres: Kubernetes limits and resources apply now to Postgres init containers.
tctl x verify gateway-certs extends verifications to include matching hostnames from configurations and certs, matching certs from secrets and running proxies, and checking invalid keys in TLS secrets.

Outstanding CVEs

PRISMA-2022-0168 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2024-10041 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-13176 - No fix available.
CVE-2025-3277 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2021-31879 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-3576 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2024-10041 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-52005 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2025-3277 - No fix available.
CVE-2025-3576 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2021-31879 - No fix available.
CVE-2025-29481 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-3576 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2025-3576 - No fix available.
CVE-2025-29087 - No fix available.
PRISMA-2021-0153 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2024-10963 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2025-29087 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2017-11164 - No fix available.
CVE-2019-20838 - No fix available.
CVE-2019-1010022 - No fix available.
CVE-2023-26604 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2024-56433 - No fix available.
CVE-2018-20796 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2010-4756 - No fix available.
CVE-2025-1376 - No fix available.
CVE-2022-41409 - No fix available.
CVE-2013-4235 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2023-26604 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2019-1010025 - No fix available.
CVE-2016-20013 - No fix available.
CVE-2025-1352 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2023-26604 - No fix available.
CVE-2023-45918 - No fix available.
CVE-2016-20013 - No fix available.
CVE-2023-29383 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2023-45918 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2016-2781 - No fix available.
CVE-2023-45918 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2019-1010024 - No fix available.
CVE-2013-4235 - No fix available.
CVE-2023-29383 - No fix available.
CVE-2013-4235 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2019-1010023 - No fix available.
CVE-2023-50495 - No fix available.
CVE-2023-29383 - No fix available.
CVE-2023-45918 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2019-9192 - No fix available.
CVE-2022-3219 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2022-41409 - No fix available.
CVE-2023-45918 - No fix available.
CVE-2024-2236 - No fix available.

Version 1.12.2

Fixed the following CVEs: CVE-2025-22869, CVE-2025-30204.
Add status subresource in the ManagementPlane and ControlPlane CRD in helm charts.
Added scale improvements in control plane operators.
Fixed WorkloadEntry generation issue because of Istio added limitation for number of labels in WorkloadEntry Spec.

Outstanding CVEs

PRISMA-2022-0168 - No fix available.
PRISMA-2021-0153 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2025-1390 - No fix available.
CVE-2025-3277 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2024-12133 - No fix available.
CVE-2025-3576 - No fix available.
CVE-2024-28180 - No fix available.
CVE-2025-30258 - No fix available.
CVE-2025-24528 - No fix available.
CVE-2025-1376 - No fix available.
PRISMA-2022-0164 - No fix available.
CVE-2025-27144 - No fix available.
CVE-2025-0395 - No fix available.
CVE-2025-29088 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2023-31484 - No fix available.
CVE-2024-26461 - No fix available.
CVE-2024-9143 - No fix available.

Version 1.12.1

Added support for multiple hosts in the n2ac component for external Postgres datastore.
Credentials provided for the data store username and password will now be automatically URL-encoded and stored in the postgres-credentials secret within the Management Plane namespace. This change helps ensure compatibility with database drivers that require URL-encoded credentials (especially when using non-standard characters). If you are already supplying URL-encoded credentials, you must do one of the following to avoid double-encoding:
1. Update the secret to remove URL encoding, or
2. Set passwordEncoding to URL in the ManagementPlane CR, as shown below:
```
spec:
  dataStore:
    passwordEncoding: URL
```
No additional action is required if your credentials are not already URL-encoded.
Prevent Direct mode objects from being attached to Bridged mode Groups.
Added the FORCE_ALLOW_REUSE_OF_EDGE_CLUSTER_NAME environment variable to XCP Central to support edge clusters that retain the same name after a control plane cluster rebuild or re-installation.
- Previously, when an edge cluster was rebuilt, it received a new UID, causing Central to reject updates from the cluster. Enabling this flag allows Central to bypass the UID check and accept updates from the edge cluster.
- When enabled, Central will accept configuration updates from clusters that share the same name. However, this can potentially overwrite updates from the original cluster, which may not be the desired behavior. As a precaution, this feature is disabled by default.
Istio IsolationBoundary is now enabled by default.
Added Alpha support for Istio Ambient mode.
Add support for XCP managed selfSigned webhook certificates.
Add option to disable cert-manager installation by using tsbManaged internal certificate provider.
Add new API to list the config status related to a given FQDN. Available with tctl status --fqdn command.
Fixed the following CVEs: CVE-2025-22870, CVE-2025-30204, CVE-2024-21235, CVE-2024-55549, CVE-2025-24855, CVE-2025-27113, CVE-2025-1094, CVE-2024-12797, CVE-2025-27144.

Upgrade Notes

If you are running TSB version 1.10.x or below without the IsolationBoundary feature enabled, please be aware that it must be enabled as a pre-upgrade step before moving to TSB version 1.12.1. This involves performing a helm upgrade --install with an updated Control Plane CR that includes the IB configuration.
- Please refer to the Non-revisioned to revisioned upgrade doc for more details.
Starting from TSB version 1.9.x, if IsolationBoundary is enabled and the upgrade steps still reference dataplane component installation, those steps must be removed from the upgrade process. The use of dataplane component is not applicable when IsolationBoundary is enabled and may cause interference. You can use --exclude-dataplane command in tctl generate manifests to generate manifests without dataplane components.
During the Control Plane upgrade, TSB will automatically upgrade the Istio installation to the latest version if istio.tsbVersion field is not specified in the IsolationBoundary configuration.
If you have IsolationBoundary enabled in your Control Plane clusters and want to opt for an automatic Istio upgrade along with the Control Plane upgrade, ensure that the istio.tsbVersion field is left empty.
```
isolationBoundaries:
- name: global
  revisions:
  - name: default
    istio: {}
  - name: canary
    istio: {}
```
In some upgrade scenarios, the previous tsb-controlplane may not terminate fully. This can lead to a race condition where the ControlPlane CR gets defaulted with a tsbVersion, reverting to older behavior. If this happens during an in-place upgrade, manually remove the tsbVersion field from the ControlPlane CR. If manual intervention isn't possible, please contact Tetrate Support to discuss adding a post-upgrade step to your pipeline.
To improve reliability, TSB has introduced changes that require a one-time transient downtime during the upgrade. The downtime will last as long as it takes for all IstioD pods to complete their upgrade.

Avoiding Downtime
- If a transient downtime during the upgrade is not acceptable, you can avoid it by applying an overlay to the IstioD deployment before upgrading.
- This overlay should modify the DISCOVERY_REVISIONS environment variable to include all revisions within the same IsolationBoundary, as well as the boundary name itself, separated by commas.
- For example, if you have two revisions i.e default and canary under the global boundary, the overlay would look like this:
```
isolationBoundaries:
- name: global
  revisions:
    - name: default
      istio:
        kubeSpec:
          deployment:
            env:
              - name: DISCOVERY_REVISIONS
                value: default,canary,global
    - name: canary
      istio:
        kubeSpec:
          deployment:
            env:
              - name: DISCOVERY_REVISIONS
                value: default,canary,global
```

UI

Fixed the backward compatibility issue of status_code and percentile metrics in the UI.
Fixed an issue where the paths and methods of LocalAuthZ could not be edited in the UI.
Fixed a bug where the service is not refreshed by the Refresh Button in the UI.
Fixed an issue where the Segmentation Toggle was wrongly displayed in the TIS+ UI.
Add support for Install Gateway.
Add Hostname and External Addresses options to the search functionality in the Workspace Propagation view.

Outstanding CVEs

CVE-2025-1376 - No fix available.
CVE-2024-10041 - No fix available.
CVE-2025-1390 - No fix available.
CVE-2024-8176 - No fix available.
CVE-2024-12243 - No fix available.
CVE-2025-1371 - No fix available.
CVE-2024-10963 - No fix available.
CVE-2024-12133 - No fix available.
CVE-2025-24528 - No fix available.
CVE-2024-52005 - No fix available.
CVE-2024- - No fix available.
CVE-2025-23022 - No fix available.
CVE-2025-1372 - No fix available.
CVE-2024-26462 - No fix available.
CVE-2025-27516 - No fix available.
CVE-2024-0406 - No fix available.
CVE-2024-2236 - No fix available.
CVE-2025-0167 - No fix available.
CVE-2024-41996 - No fix available.
CVE-2023-29383 - No fix available.
CVE-2024-9143 - No fix available.
CVE-2023-7008 - No fix available.
CVE-2024-22365 - No fix available.

Version 1.12.0

Added the K8S_CACHE_SYNC_TIMEOUT environment variable to the TSB operators to configure the amount to wait for the Kubernetes cache synchronization when the operator pods start. The default value is 2 minutes, but in large environments with lots of configuration objects this may need to be increased.

The rate limit filters were not installed on the listeners on port 15443, used for multi-cluster traffic. Starting in 1.12, rate limits will also be enforced for traffic going through that port. This could be a breaking change for some applications, and can be turned off by applying the following overlay in the ControlPlane resource in the application clusters

spec:
  components:
    xcp:
      kubeSpec:
        overlays:
        - apiVersion: install.xcp.tetrate.io/v1alpha1
          kind: EdgeXcp
          name: edge-xcp
          patches:
          - path: spec.components.edgeServer.kubeSpec.deployment.env[-1]
            value:
              name: DISABLE_RATE_LIMIT_PORT_15443
              value: "true"

The built-in roles have been updated to include permissions to manage configuration profiles.
Segmentation Membership objects now accept the FQN of Cluster objects in the fqnSelector field to create cluster-based policies.
Traffic settings in configuration profiles have been moved from the trafficSettings field to a new traffic field. All traffic-related settings are now enforced exclusively under the inbound and outbound fields, available in both the defaults and mandates sections of a profile. You can rely on the deprecation warnings in the TrafficSettings filed documentation to help identify where the deprecated fields have been relocated in the new structure. Example migration: Before:
```
mandates:
  trafficSettings:
    reachability:
      mode: CUSTOM
      hosts:
        - ns1/*
```
After:
```
mandates:
  traffic:
    outbound:
      reachability:
        mode: CUSTOM
        hosts:
          - ns1/*
```

Upgrade notes

OAP Upgrade

OAP adds more attributes to metrics for querying and analysis. When upgrading, OAP can assure the compatibility between management plane and control plane. But within a cluster, OAP instances route and aggregate metrics from each other. So rolling an update in a cluster can cause replicas to temporarily stop aggregating metrics while they are running lower version and master version at the same time. This could output some predictable errors in the logs, like:

2025-02-20 10:18:21,922 - org.apache.skywalking.oap.server.core.remote.RemoteServiceHandler -44362 [grpc-default-executor-1] ERROR [] - Index 2 out of bounds for length 2

The OAP instances will recover aggregating metrics and stop printing the above logs when the upgrade is completed. Although this case is normal and predictable, if you want to avoid this, you can upgrade OAP by the following steps:

Before upgrading, scale down the OAP replicas to 0.
Recover OAP replicas after the deployment is upgraded.

Version 1.12.15​

Outstanding CVEs​

Version 1.12.14​

Outstanding CVEs​

Version 1.12.13​

Outstanding CVEs​

Version 1.12.12​

Outstanding CVEs​

Version 1.12.11​

Outstanding CVEs​

Version 1.12.10​

Outstanding CVEs​

Version 1.12.9​

Outstanding CVEs​

Version 1.12.8​

Outstanding CVEs​

Version 1.12.7​

Outstanding CVEs​

Version 1.12.6​

Outstanding CVEs​

Version 1.12.5​

UI​

Outstanding CVEs​

Version 1.12.4​

Outstanding CVEs​

Version 1.12.3​

Outstanding CVEs​

Version 1.12.2​

Outstanding CVEs​

Version 1.12.1​

Upgrade Notes​

Avoiding Downtime​

UI​

Outstanding CVEs​

Version 1.12.0​

Upgrade notes​

OAP Upgrade​

Version 1.12.15

Outstanding CVEs

Version 1.12.14

Outstanding CVEs

Version 1.12.13

Outstanding CVEs

Version 1.12.12

Outstanding CVEs

Version 1.12.11

Outstanding CVEs

Version 1.12.10

Outstanding CVEs

Version 1.12.9

Outstanding CVEs

Version 1.12.8

Outstanding CVEs

Version 1.12.7

Outstanding CVEs

Version 1.12.6

Outstanding CVEs

Version 1.12.5

UI

Outstanding CVEs

Version 1.12.4

Outstanding CVEs

Version 1.12.3

Outstanding CVEs

Version 1.12.2

Outstanding CVEs

Version 1.12.1

Upgrade Notes

Avoiding Downtime

UI

Outstanding CVEs

Version 1.12.0

Upgrade notes

OAP Upgrade