Cilium Files

Security patch release

Out-of-band security patch release to fix CVE-2026-111943 ([golang/go#82345](https://github.com/golang/go/issues/82345)): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.

Summary of Changes

Minor Changes:

• alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR [#49474], Upstream PR [#49093], @4n4nd)

Bugfixes:

• Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR [#49474], Upstream PR [#47828], @TheBeeZee)
• bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR [#49474], Upstream PR [#48819], @fds7280)
• CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR [#49474], Upstream PR [#49076], @maxskokov)
• datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR [#49474], Upstream PR [#49177], @HadrienPatte)
• Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR [#49474], Upstream PR [#48349], @taesung320)
• Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR [#49474], Upstream PR [#49204], @liuyuan10)
• Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR [#49568], Upstream PR [#49525], @youngnick)
• Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR [#49474], Upstream PR [#48938], @0xch4z)
• nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR [#49390], Upstream PR [#49242], @41ks)
• Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR [#49474], Upstream PR [#49112], @QxBytes)
• Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR [#49474], Upstream PR [#49380], @aanm)

CI Changes:

• [v1.20] ci: ignore transient xDS mode drift during downgrade ([#49515], @jrajahalme)
• ci: Pass the auto-committer secrets to the base images workflow (Backport PR [#49467], Upstream PR [#49453], @aanm)
• renovate: Open one trusted PR per branch (Backport PR [#49416], Upstream PR [#49381], @aanm)

Misc Changes:

• chore(deps): update auto-merge-trusted-deps (v1.20) ([#49319], @cilium-renovate[bot])
• chore(deps): update auto-merge-trusted-deps (v1.20) ([#49445], @cilium-renovate[bot])
• chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) ([#49438], @cilium-renovate[bot])
• clarify co sign documentation to use minimum version to verify signing key (Backport PR [#49474], Upstream PR [#49401], @mfahlandt)
• Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR [#49383], Upstream PR [#48897], @jrajahalme)

Other Changes:

• install: Update image digests for v1.20.3 ([#49392], @cilium-release-bot[bot])
• route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler ([#49170], @andreaterzolo)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa

hubble-relay

quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1 quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad

operator-aws

quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c

operator-azure

quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec

operator-generic

quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82 quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82

operator

quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263 quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263