We released an updated version of the Apigee hybrid software, v1.14.9

## Announcement Announcement ### v1.14.9 On October 7, 2026 we released an updated version of the Apigee hybrid software, v1.14.9. * For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.9](https://cloud.google.com/apigee/docs/hybrid/v1.14/upgrade). * For information on new installations, see [The big picture](https://cloud.google.com/apigee/docs/hybrid/v1.14/big-picture). **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://cloud.google.com/apigee/docs/release/apigee-release-process#apigee-hybrid-container-images). ## Fix Fixed #### Fixed in this release | Bug ID | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **565072374** | **Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** | | **564969400** | **Fixed an issue where variables initialized from an empty <Value/> element in AssignMessage (AssignVariable) were not treated as empty strings when referenced in message template functions such as replaceAll.** | | **558888960** | **Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.** | | **554114419** | **Apigee hybrid now allows policies to modify HTTP/2 request pseudo-headers (:path and :authority) when communicating over HTTP/2.** | | **548763108** | **Hardened Message Processor outbound HTTP validation to block requests to internal Kubernetes cluster hostnames (\*.svc.cluster.local).** | | **513032450** | **Fixed an issue where apigee-connect-agent control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** | ## Security Security | Bug ID | Description | | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **N/A** | **Security fixes for apigee-asm-ingress.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for apigee-asm-istiod.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for apigee-connect-agent.** This addresses the following vulnerabilities: [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-fluent-bit.** This addresses the following vulnerabilities: [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | | **N/A** | **Security fixes for apigee-hybrid-cassandra-client.** This addresses the following vulnerabilities: [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-kube-rbac-proxy.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-mart-server.** This addresses the following vulnerabilities: [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for apigee-mint-task-scheduler.** This addresses the following vulnerabilities: [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for apigee-open-telemetry-collector.** This addresses the following vulnerabilities: [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) [CVE-2026-81872](https://nvd.nist.gov/vuln/detail/CVE-2026-81872) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-operators.** This addresses the following vulnerabilities: [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-prom-prometheus.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for apigee-prometheus-adapter.** This addresses the following vulnerabilities: [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-runtime.** This addresses the following vulnerabilities: [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for apigee-synchronizer.** This addresses the following vulnerabilities: [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for apigee-udca.** This addresses the following vulnerabilities: [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for apigee-watcher.** This addresses the following vulnerabilities: [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |