We released an updated version of the Apigee hybrid software, v1.16.11
Share
Services
## Announcement
Announcement
### v1.16.11
On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11.
* For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.11](https://cloud.google.com/apigee/docs/hybrid/v1.16/upgrade).
* For information on new installations, see [The big picture](https://cloud.google.com/apigee/docs/hybrid/v1.16/big-picture).
**Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://cloud.google.com/apigee/docs/release/apigee-release-process#apigee-hybrid-container-images).
## Fix
Fixed
#### Fixed in this release
| Bug ID | Description |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **565072374** | **Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** |
| **556680325** | **Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the SemanticCacheLookup policy.** |
| **535395491** | **Extension Processor (ext\_proc) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP 500.** |
| **513032450** | **Fixed an issue where apigee-connect-agent control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** |
| **502540992** | **Fixed an issue where the SemanticCacheLookup policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints by adding gRPC transport support via <PrivateServiceConnect><GrpcEndpoint>.** |
| **492042425** | **Fixed an issue in the LLMTokenQuota policy where operation-level token quota values configured on an API product were not applied at runtime, causing product-level quota values to be enforced instead.** |
## Security
Security
| Bug ID | Description |
| ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **N/A** | **Security fixes for apigee-fluent-bit.** This addresses the following vulnerabilities: [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) |
| **N/A** | **Security fixes for apigee-hybrid-cassandra-client.** This addresses the following vulnerability: [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for apigee-kube-rbac-proxy.** This addresses the following vulnerabilities: [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) |
| **N/A** | **Security fixes for apigee-mart-server.** This addresses the following vulnerabilities: [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for apigee-mint-task-scheduler.** This addresses the following vulnerabilities: [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for apigee-prom-prometheus.** This addresses the following vulnerabilities: [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) |
| **N/A** | **Security fixes for apigee-prometheus-adapter.** This addresses the following vulnerability: [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) |
| **N/A** | **Security fixes for apigee-runtime.** This addresses the following vulnerabilities: [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
| **N/A** | **Security fixes for apigee-synchronizer.** This addresses the following vulnerabilities: [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) |
What else is happening at Google Cloud Platform?
Read update
Services
Share
For GKE Standard CPU node pools, GKE can now upgrade nodes by updating the existing
about 8 hours ago
Services
Share
Read update
Services
Share