Skip to main content

v0.8.1

Released October 27, 2026. Supported until April 27, 2027.

v0.8.1 ships 4 security updates, including the fix for the critical Brotli decoder vulnerability CVE-2026-111497 in Envoy proxies. Two root certificates are removed from the gateway and proxy images, so an upstream certificate that chains only to one of them is replaced before the upgrade. v0.8.1 shipped after v0.9.0, which carries neither the Brotli fix nor the root removal: an upgrade from v0.8.1 to v0.9.0 loses both.

About these release notes

A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.

The full release notes are opened from the Admin Console, as described in Check the management plane version.

Upgrade and rollback​

  • The release carries no breaking change. 3 changes name operator steps of their own, given with each change in the full release notes in the Admin Console.
  • The upgrade rolls through without dropping traffic.
  • Rollback to v0.8.0 is unconditional.

Security updates​

Gateway​

The AAA Certificate Services and emSign ECC Root CA - G3 root certificates are removed from the trust bundle of the gateway and Envoy proxy images, so TLS verification in those images rejects certificate chains that depend on either root. An upstream certificate whose only valid chain ends at one of these roots, in particular AAA Certificate Services, is replaced before the gateway and proxy images are upgraded. The gateway controller and the gateway's filter module are also built with Go releases that include the fix for blocked intermediate certificates (CVE-2026-111943).

The AI Gateway controller and external processor are built with Go 1.27.3, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates. Their trust bundle is unchanged and still contains both removed roots.

Envoy proxies include the fix for the critical Brotli decoder vulnerability CVE-2026-111497 (GHSA-3wvj-j6qm-62mr), protecting proxies that decode Brotli-compressed requests.

Helm charts​

The rate limit service, the kubectl and secret bootstrap images, and the Google Secret Manager client that the management plane services run at startup are built with Go 1.26.10, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates.