We released an updated version of the Apigee hybrid software, v1.15.8

## Announcement Announcement ### v1.15.8 On September 24, 2026 we released an updated version of the Apigee hybrid software, v1.15.8. * For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.8](https://cloud.google.com/apigee/docs/hybrid/v1.15/upgrade). * For information on new installations, see [The big picture](https://cloud.google.com/apigee/docs/hybrid/v1.15/big-picture). **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://cloud.google.com/apigee/docs/release/apigee-release-process#apigee-hybrid-container-images). ## Fix Fixed #### Fixed in this release | Bug ID | Description | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **535928300** | **Fixed a security issue in JWT refresh token revocation handling.** | | **535683286** | **Fixed a security issue in HTTP target interim-response (103 Early Hints) handling to prevent response desynchronization.** | | **534852923** | **Fixed a security issue in the JavaCallout policy.** | | **534420582** | **The JSONThreatProtection policy now supports an optional <RejectDuplicateKeys> child element that rejects JSON payloads containing duplicate keys within the same object.** | | **531773665** | **Fixed an issue where the VerifyAPIKey policy could fail with a NullPointerException when reading developer attributes.** | | **469642464** | **Improved input validation in AI protection policies to prevent server-side request forgery (SSRF).** | | **449228485** | **Apigee hybrid now supports configuring custom Kubernetes PodDisruptionBudget (minAvailable or maxUnavailable) values for Apigee hybrid components in your overrides.yaml file.** | ## Security Security | Bug ID | Description | | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **N/A** | **Security fixes for apigee-asm-ingress.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-asm-istiod.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-connect-agent.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-fluent-bit.** This addresses the following vulnerabilities: [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | | **N/A** | **Security fixes for apigee-hybrid-cassandra.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) [GHSA-72hv-8253-57qq](https://osv.dev/vulnerability/GHSA-72hv-8253-57qq) [GHSA-r7wm-3cxj-wff9](https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9) | | **N/A** | **Security fixes for apigee-hybrid-cassandra-client.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-mart-server.** This addresses the following vulnerabilities: [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for apigee-mint-task-scheduler.** This addresses the following vulnerabilities: [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for apigee-open-telemetry-collector.** This addresses the following vulnerabilities: [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-operators.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) [GHSA-w67g-5rqw-f597](https://osv.dev/vulnerability/GHSA-w67g-5rqw-f597) | | **N/A** | **Security fixes for apigee-prom-prometheus.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-prometheus-adapter.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for apigee-redis.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for apigee-runtime.** This addresses the following vulnerabilities: [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for apigee-synchronizer.** This addresses the following vulnerabilities: [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for apigee-watcher.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | ## Change Change **Correction: API base path limit for Apigee hybrid organizations** The [December 16, 2024](https://cloud.google.com/apigee/docs/hybrid/release-notes#December%5F16%5F2024) release note for enhanced per-environment proxy limits stated that the maximum number of API base paths per Apigee organization is 3000\. That number is incorrect. The maximum number of API base paths per organization is 6,000 for both Apigee and Apigee hybrid. For optimal performance, Apigee recommends using no more than 3,000 API proxy basepaths per environment or environment group. This is a recommendation, not an enforced limit. For more information, see [Limits](https://cloud.google.com/apigee/docs/api-platform/reference/limits#environment-and-organization) and [Enhanced per-environment proxy limits](https://cloud.google.com/apigee/docs/hybrid/v1.17/enhanced-proxy-limits).