Envoy Gateway 1.9.1 Reverses Upgrade Bugs While Tightening TLS and OAuth2 Security

What's in the update#

Envoy Gateway 1.9.1, released on August 28, reverses a troublesome configuration change from version 1.9.0 and bolsters several security mechanisms across TLS, OAuth2, and Wasm module handling. The release targets deployment reliability, credential security, and observability for teams running this Kubernetes-native ingress controller at scale.

The timeout reversal that fixes silent outages#

Version 1.9.0 set the initial fetch timeout for Secret Discovery Service (SDS) and Route Discovery Service (RDS) to zero—effectively removing a deadline. This change caused clusters waiting for missing certificates or endpoints to enter an indefinite warming state, which blocked configuration distribution and health checks. Version 1.9.1 restores Envoy's default 15-second timeout, returning behavior to the v1.8.x baseline.

The fix carries complications for users already on 1.9.0. When the controller upgrades and changes SDS configuration, running proxies can experience a race condition: TLS listeners activate before their certificates arrive, causing HTTPS handshakes to fail. Backend TLS and global rate-limit services face similar certificate gaps. A reported production outage showed long-running proxies losing downstream TLS certificates entirely, requiring manual restarts.

Upgrade path guidance:

• From v1.8.x: Upgrade directly to v1.9.1 and skip v1.9.0
• From v1.9.0: Execute a rolling update that swaps proxy pods quickly (requires spare cluster capacity; expect WebSocket and gRPC connection terminations)

Encryption and session hardening#

Envoy Gateway now enforces AES-256-GCM for OAuth2/OIDC session-cookie encryption and removes legacy AES-256-CBC support, closing a padding-oracle vulnerability (CVE-2026-47775). Users with active sessions encrypted under the old method will need to re-authenticate post-upgrade. Custom bootstrap configurations must explicitly set the corresponding runtime settings.

Additional security tightening includes stricter OIDC issuer URL validation and a fix preventing tenant-supplied security contexts from overriding hardened defaults—which could otherwise strip privileges like blocking root execution or privileged mode.