--- title: Envoy Gateway 1.9.1 Tightens Security and Addresses a... description: Envoy Gateway v1.9.1 is a maintenance release reversing a problematic v1.9.0 change that set the SDS/RDS initial fetch timeout to zero, which could leave... canonical: https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Envoy Gateway 1.9.1 Tightens Security and Addresses a Difficult Upgrade Path | daily.dev og:description: Envoy Gateway v1.9.1 is a maintenance release reversing a problematic v1.9.0 change that set the SDS/RDS initial fetch timeout to zero, which could leave... og:url: https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2 og:image: https://api.daily.dev/og/posts/1IcxWdpG2.png og:image:alt: Envoy Gateway 1.9.1 Tightens Security and Addresses a Difficult Upgrade Path og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Envoy Gateway 1.9.1 Tightens Security and Addresses a Difficult Upgrade Path **[InfoQ](https://daily.dev/sources/infoq)** · 5 min read · 0 upvotes · 0 comments ## Summary Envoy Gateway v1.9.1 is a maintenance release reversing a problematic v1.9.0 change that set the SDS/RDS initial fetch timeout to zero, which could leave clusters stuck in a warming state and delay health checks. The release restores the 15-second default but warns that organizations already on v1.9.0 face a complicated upgrade: TLS listeners can activate without certificates during controller upgrades, breaking new TLS handshakes. Security fixes include switching OAuth2/OIDC session-cookie encryption to AES-256-GCM and dropping the vulnerable AES-256-CBC path (CVE-2026-47775), removing an insecure HTTPS-to-HTTP fallback for OCI Wasm image pulls, and closing a security-context bypass that let tenant configs override hardened defaults. Other improvements include EDS-based rate-limit service discovery and per-phase tracing spans for Gateway API and xDS translation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I safely upgrade from Envoy Gateway 1.9.0 to 1.9.1 without breaking TLS? Use a rolling-update configuration that replaces proxy pods quickly, since changing the SDS configuration during the controller upgrade can leave running v1.9.0 proxies with TLS listeners active but without certificates, causing new TLS handshakes to fail. This requires sufficient cluster capacity and can terminate long-lived WebSocket and gRPC connections as pods are replaced. Users still on v1.8.x should skip v1.9.0 and upgrade directly to v1.9.1. _daily.dev surfaces release notes like this so teams can plan risky upgrades before they break production TLS._ ### What CVE does Envoy Gateway 1.9.1 fix in OAuth2/OIDC session cookies? Envoy Gateway 1.9.1 fixes CVE-2026-47775, a padding-oracle vulnerability in the legacy AES-256-CBC session-cookie decryption path. The release enables AES-256-GCM for OAuth2/OIDC session-cookie encryption and removes the vulnerable CBC path entirely. Existing sessions encrypted with the older mechanism will be invalidated, forcing users to re-authenticate after the upgrade, and deployments using a replacement Envoy bootstrap must configure matching runtime settings. _Developers patching auth-related CVEs can track advisories like this one on daily.dev before they become incidents._ ### Why did Envoy Gateway 1.9.0 cause clusters to get stuck in a warming state? Envoy Gateway 1.9.0 changed the initial fetch timeout for Secret Discovery Service (SDS) and Route Discovery Service (RDS) to zero, causing a cluster waiting indefinitely for a missing secret or endpoint to remain in a warming state. This blocked CDS updates from progressing and delayed health checks. Version 1.9.1 reverses this by restoring Envoy's default 15-second timeout, returning behavior to the v1.8.x model. _daily.dev helps engineers debugging gateway upgrade regressions spot root-cause explanations like this one._ ## Similar posts on daily.dev - [Announcing Istio 1.29.1](https://daily.dev/posts/announcing-istio-1-29-1-csqoovfig) · Istio · 1 upvotes · 0 comments - [Announcing Istio 1.29.3](https://daily.dev/posts/announcing-istio-1-29-3-cekhvqthq) · Istio · 2 upvotes · 0 comments - [Kgateway v2.1 is released\!](https://daily.dev/posts/kgateway-v2-1-is-released--ohfqye167) · CNCF · 28 upvotes · 0 comments - [Announcing Istio 1.28.8](https://daily.dev/posts/announcing-istio-1-28-8-epijyju4g) · Istio · 0 upvotes · 0 comments - [Isovalent Networking for Kubernetes 1.18: New Routing, Policy, and Observability Enhancements](https://daily.dev/posts/isovalent-networking-for-kubernetes-1-18-new-routing-policy-and-observability-enhancements-uehiidtza) · Isovalent · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#appsec](https://daily.dev/tags/appsec), [#gateway-api](https://daily.dev/tags/gateway-api) [View this post on daily.dev](https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Envoy Gateway 1.9.1 Tightens Security and Addresses a Difficult Upgrade Path","url":"https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2"},"datePublished":"2026-10-02T12:03:02.012Z","dateModified":"2026-10-02T12:03:29.411Z","description":"Envoy Gateway v1.9.1 is a maintenance release reversing a problematic v1.9.0 change that set the SDS/RDS initial fetch timeout to zero, which could leave...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b347c92df0e19d6aaa28b4f277210d7e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b347c92df0e19d6aaa28b4f277210d7e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,appsec,gateway-api","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Envoy Gateway 1.9.1 Tightens Security and Addresses a Difficult Upgrade Path"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/envoy-gateway-1-9-1-tightens-security-and-addresses-a-difficult-upgrade-path-1icxwdpg2#faq","mainEntity":[{"@type":"Question","name":"How do I safely upgrade from Envoy Gateway 1.9.0 to 1.9.1 without breaking TLS?","acceptedAnswer":{"@type":"Answer","text":"Use a rolling-update configuration that replaces proxy pods quickly, since changing the SDS configuration during the controller upgrade can leave running v1.9.0 proxies with TLS listeners active but without certificates, causing new TLS handshakes to fail. This requires sufficient cluster capacity and can terminate long-lived WebSocket and gRPC connections as pods are replaced. Users still on v1.8.x should skip v1.9.0 and upgrade directly to v1.9.1. daily.dev surfaces release notes like this so teams can plan risky upgrades before they break production TLS."}},{"@type":"Question","name":"What CVE does Envoy Gateway 1.9.1 fix in OAuth2/OIDC session cookies?","acceptedAnswer":{"@type":"Answer","text":"Envoy Gateway 1.9.1 fixes CVE-2026-47775, a padding-oracle vulnerability in the legacy AES-256-CBC session-cookie decryption path. The release enables AES-256-GCM for OAuth2/OIDC session-cookie encryption and removes the vulnerable CBC path entirely. Existing sessions encrypted with the older mechanism will be invalidated, forcing users to re-authenticate after the upgrade, and deployments using a replacement Envoy bootstrap must configure matching runtime settings. Developers patching auth-related CVEs can track advisories like this one on daily.dev before they become incidents."}},{"@type":"Question","name":"Why did Envoy Gateway 1.9.0 cause clusters to get stuck in a warming state?","acceptedAnswer":{"@type":"Answer","text":"Envoy Gateway 1.9.0 changed the initial fetch timeout for Secret Discovery Service (SDS) and Route Discovery Service (RDS) to zero, causing a cluster waiting indefinitely for a missing secret or endpoint to remain in a warming state. This blocked CDS updates from progressing and delayed health checks. Version 1.9.1 reverses this by restoring Envoy's default 15-second timeout, returning behavior to the v1.8.x model. daily.dev helps engineers debugging gateway upgrade regressions spot root-cause explanations like this one."}}]} ```