--- schema_version: "1" id: 3ab7ae58cfcc2f6670d9ceab23ba3f1affa4b93aa991d92d7f70f4dea244a232 title: Omni Gateway Release Notes collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/release-notes/gateway/gateway-release-notes.md canonical_url: https://docs.mulesoft.com/release-notes/gateway/gateway-release-notes source_site: docs.mulesoft.com content_type: documentation content_hash: 9d2aaa1fc7e23bb6705165e568ad19d3fe6bc253c652a899944f5f959bf291ed description: MuleSoft Documentation Site latest: true --- # Omni Gateway Release Notes These release notes reflect enhancements, changes, and bug fixes for Omni Gateway. In addition to these release notes, see: - [Model Proxy Release Notes](https://docs.mulesoft.com/release-notes/gateway/model-proxy-release-notes) ## [](#1-14-4)1.14.4 **October 23, 2026** MuleSoft announces the release of Omni Gateway 1.14.4. ### What’s New - Custom PDK policies can now access an API instance’s configured consumer URL through `api.consumerUri` in API Context. ### Fixed Issues

Issue Resolution

Omni Gateway now rejects certificates chaining through known compromised eMudhra intermediate certificates.

W-24628768

These vulnerabilities detected by scanners are now fixed:

CVE-2026-35189
CVE-2026-35191
CVE-2026-42772
CVE-2026-54872
CVE-2026-54873
CVE-2026-54875
CVE-2026-72897
CVE-2026-75804
CVE-2026-75805
CVE-2026-75806

CVE-2026-77696
CVE-2026-78659
CVE-2026-78660
CVE-2026-78663
CVE-2026-78669
CVE-2026-84782
CVE-2026-84784
CVE-2026-97032
CVE-2026-111943

W-24624014

## [](#1-14-3)1.14.3 **October 20, 2026** MuleSoft announces the release of Omni Gateway 1.14.3. ### What’s New - Envoy is now upgraded to version 1.37.8. - Tracing custom labels now support integer, floating-point, and boolean OpenTelemetry attributes, and values resolved through Envoy substitution expressions. - The Credential Injection API Key policy now supports DataWeave expressions to resolve the API key from request attributes or payloads at runtime. ### Fixed Issues

Issue Resolution ID

Path normalization is now disabled by default. To enable it, set FLEX_PATH_NORMALIZATION_ENABLED to true.

W-24443266

Helm deployments now preserve a configured API address trailing slash and enable base-path canonicalization by default. APIs configured with a slashless base path can accept requests to that exact base path.

W-24541915

Omni Gateway now uses /var/tmp for temporary files, avoiding failures in containers with a read-only root filesystem.

W-24279051

Runtime Fabric Helm deployments now normalize wildcard-prefixed forward-proxy exclusions and omit unsupported CIDR entries.

W-24460337

Helm-generated inbound TLS bindings now apply the correct TLS-context precedence when APIs share a listener.

W-24511699

Gateway-agent configuration generation now uses less memory when multiple distinct WebAssembly policies are applied.

W-24390601

The Injection Protection policy no longer incorrectly rejects legitimate multipart SOAP requests with binary attachments when body scanning is enabled.

W-24361237

The JWT Validation policy now accepts RSA keys with padded base64url parameters in JWKS responses.

W-24309516

Control-node replicas now retry concurrent revision updates with backoff instead of failing deployments with a precondition error.

W-24580345

These vulnerabilities detected by scanners are now fixed:

CVE-2026-48521
CVE-2026-50572
CVE-2026-56857
CVE-2026-56866
CVE-2026-73511
CVE-2026-73512
CVE-2026-73513
CVE-2026-73546
CVE-2026-73547
CVE-2026-73548
CVE-2026-73549

CVE-2026-73550
CVE-2026-73551
CVE-2026-73552
CVE-2026-73553
CVE-2026-78667
CVE-2026-94439
CVE-2026-94440
CVE-2026-94448
CVE-2026-97030
CVE-2026-97031

W-24456219, W-24578725

## [](#1-14-2)1.14.2 **October 1, 2026** MuleSoft announces the release of Omni Gateway 1.14.2. ### Fixed Issues

Issue Resolution ID

Issue Resolution	ID
The JWT Validation, OpenID Connect OAuth 2.0 Token Enforcement, and OAuth 2.0 Token Introspection policies now preserve path segments and trailing slashes from consumer URLs when generating protected resource metadata URLs.	W-24119444
Omni Gateway now preserves percent-encoded reserved characters, such as `%2F` and `%3A`, in upstream URL paths when forwarding requests to backend services.	W-24135806
Per-API message logs in API Manager now populate correctly for Omni Gateway registrations that use v1 URLs.	W-24332213

The JWT Validation, OpenID Connect OAuth 2.0 Token Enforcement, and OAuth 2.0 Token Introspection policies now preserve path segments and trailing slashes from consumer URLs when generating protected resource metadata URLs.

W-24119444

Omni Gateway now preserves percent-encoded reserved characters, such as %2F and %3A, in upstream URL paths when forwarding requests to backend services.

W-24135806

Per-API message logs in API Manager now populate correctly for Omni Gateway registrations that use v1 URLs.

W-24332213

## [](#1-14-1)1.14.1 **September 25, 2026** MuleSoft announces the release of Omni Gateway 1.14.1. ### What’s New - Managed Omni Gateway deployments on Runtime Fabric now support forward proxy configuration. - `Configuration` resources now support environment variable expansion in string and scalar values. - Self-Managed Omni Gateway can now internally rewrite requests that exactly match a configured slashless API base path, such as `/api`, to its slash-terminated form (`/api/`). Set `FLEX_BASE_PATH_CANONICALIZER_ENABLED` to `true` to enable this behavior. - The Message Logging policy now supports masking regex capture groups while preserving the rest of the matched value. ### Fixed Issues

Issue Resolution ID

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

Log records larger than 32 KB no longer split into separate lines that lose their logging metadata. Oversized records are truncated instead.

W-24055090

Omni Gateway running in Connected Mode no longer sends duplicate runtime logs to Anypoint Platform after logging configuration changes.

W-24037601

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied twice.

W-24195540

The Basic Authentication: LDAP policy no longer includes sensitive authentication data in logs.

W-24118398

The OpenID Connect OAuth 2.0 Token Enforcement policy now correctly applies defaultTLS.outboundPolicyCalls to identity-provider token requests without applying those settings to Anypoint Platform connections.

W-24268807

Tracing now preserves custom server span names without forwarding the x-envoy-decorator-operation header to upstream services. Upstream-only span tags no longer appear on server spans.

W-23923463

These vulnerabilities detected by scanners are now fixed:

CVE-2026-5450
CVE-2026-5928

GHSA-2v4p-qf9q-27wj
GHSA-8wmf-6v46-5gfg

W-24126253

## [](#1-14-0)1.14.0 **September 2, 2026** MuleSoft announces the release of Omni Gateway 1.14.0. ### What’s New - The JavaScript Scripting policy is added to run a user-supplied JavaScript module that can inspect and modify requests and responses directly from the gateway. See [JavaScript Scripting Policy](https://docs.mulesoft.com/gateway/latest/policies-included-javascript-scripting). - The GraphQL Access Control policy is added to authorize incoming GraphQL requests by evaluating Cedar-based access-control rules. See [GraphQL Access Control Policy](https://docs.mulesoft.com/gateway/latest/policies-included-graphql-access-control). - Local storage is now file-based instead of in-memory. State used by policies such as Rate Limiting and HTTP Caching are now retained when Omni Gateway is stopped or restarted. - Configuration caching (control node) is now enabled by default. The `FLEX_DATASOURCE_CONTROL_NODE_ENABLED` environment variable now defaults to `true`. To disable it, set the variable to `false`. See [Configuring Omni Gateway Configuration Caching in Connected Mode](https://docs.mulesoft.com/gateway/latest/conn-replica-caching). - The OpenID Connect OAuth 2.0 Token Enforcement policy now exposes the **Validated Token TTL** (`maxFederationExpirationTime`) and **Maximum Cache Entries** (`maxCacheSize`) settings in Connected Mode to control how long validated tokens are cached and how many entries are stored. See [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-openid-token-enforcement). - The JWT Validation policy now supports OAuth 2.0 Protected Resource Metadata (RFC 9728). When enabled, the policy serves a discovery document at the `.well-known/oauth-protected-resource` endpoint and adds a `resource_metadata` hint to the `WWW-Authenticate` header of `401` responses, so clients can locate the authorization server that protects the API. See [JWT Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-jwt-validation). - The Credential Injection OAuth 2.0 policy now supports adding custom parameters, such as `audience`, to the OAuth 2.0 token request body. See [Credential Injection OAuth 2.0 Policy](https://docs.mulesoft.com/gateway/latest/policies-outbound-oauth). - The Message Logging policy now supports data masking to detect and mask personally identifiable information (PII), such as email addresses, in log messages before they are written. You can select built-in PII types (Email, US SSN, Credit Card, and Phone Number) or add custom regex patterns. Data masking is available for both inbound and outbound message logging, and request and response bodies are forwarded to the upstream service unchanged. See [Message Logging Policy](https://docs.mulesoft.com/gateway/latest/policies-included-message-logging) and [Outbound Message Logging Policy](https://docs.mulesoft.com/gateway/latest/policies-outbound-message-logging). - The Schema Validation policy now validates `multipart/form-data` requests against their OAS schema definitions, in addition to `application/json` request bodies. See [Schema Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-schema-validation). - You can now configure the DNS refresh rate for upstream service clusters by setting the `FLEX_DNS_REFRESH_RATE` environment variable. The value is clamped between `5s` and `60s`, and defaults to `5s`. - The `flexctl dump` CLI command now collects a full snapshot of the gateway’s runtime state into a single ZIP file, including resources, logs, and Envoy statistics. You can write the snapshot to a specific path or stream it to standard output. See [Troubleshooting with the CLI](https://docs.mulesoft.com/gateway/latest/troubleshoot-admin-api). - The implementation of the DataWeave and SOAP policies is updated to improve policy performance, delivering higher throughput and lower latency. - The `flexctl check http` command now produces curl-style verbose output, logging request and response headers with `>` and `<` prefixes and writing the response body to standard output for easier scripting and inspection. - Flex Gateway deployments managed by Runtime Fabric for Kubernetes now support pod scheduling customizations (node selectors, tolerations, and affinity rules) defined through a KubernetesTemplate custom resource. Customizations take precedence over the corresponding chart-level settings when both are present. - Omni Gateway Docker images are now based on Debian 13 Distroless. ### Fixed Issues

Issue Resolution ID

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The WebSocket Connection Limit policy no longer omits rejected connections from the policy violations reported to Anypoint Monitoring.

W-23173354

Flex Gateway no longer rejects valid requests when an API specification (OAS) uses a decimal multipleOf constraint (such as 0.01, 0.001, or 0.1).

W-23192298

Omni Gateway no longer reports as ready when a deployment has failed (for example, when assets could not be downloaded), even when --allow-envoy-errors, --allow-api-errors, or --allow-policy-errors is set to true.

W-23543048

Flex Gateway no longer hangs when its shared storage configuration changes while the gateway is running.

W-23573044

Flex Gateway no longer fails to generate a valid FluentBit log configuration when a label used for log metadata (on the gateway, an API instance, or a service) has an empty value or contains spaces.

W-23147140

Flex Gateway no longer panics when the status and dump endpoints are called before the gateway configuration is fully available during startup.

W-23950422

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-56853

CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-56864
CVE-2026-56865

W-22733262

## [](#1-13-8)1.13.8 **October 23, 2026** MuleSoft announces the release of Omni Gateway 1.13.8. ### What’s New - Custom PDK policies can now access an API instance’s configured consumer URL through `api.consumerUri` in API Context. ### Fixed Issues

Issue Resolution

Omni Gateway now rejects certificates chaining through known compromised eMudhra intermediate certificates.

W-24628768

These vulnerabilities detected by scanners are now fixed:

CVE-2026-35189
CVE-2026-35191
CVE-2026-42772
CVE-2026-54872
CVE-2026-54873
CVE-2026-54875
CVE-2026-72897
CVE-2026-56857
CVE-2026-56866
CVE-2026-78667
CVE-2026-84782

CVE-2026-75804
CVE-2026-75805
CVE-2026-75806
CVE-2026-77696
CVE-2026-84784
CVE-2026-94439
CVE-2026-94440
CVE-2026-94448
CVE-2026-97030
CVE-2026-97031
CVE-2026-111943

W-24624014

## [](#1-13-7)1.13.7 **October 21, 2026** MuleSoft announces the release of Omni Gateway 1.13.7. ### What’s New - Envoy is now upgraded to version 1.37.8. - The Credential Injection API Key policy now supports DataWeave expressions to resolve the API key from request attributes or payloads at runtime. ### Fixed Issues

Issue Resolution ID

Path normalization is now disabled by default. To enable it, set FLEX_PATH_NORMALIZATION_ENABLED to true.

W-24443266

Omni Gateway now uses /var/tmp for temporary files, avoiding failures in containers with a read-only root filesystem.

W-24279051

Helm-generated inbound TLS bindings now apply the correct TLS-context precedence when APIs share a listener.

W-24511699

Omni Gateway no longer crashes during startup in disconnected Runtime Fabric deployments when platform logging, monitoring, or metering endpoints are unavailable.

W-24525793

The Header Injection policy no longer crashes Omni Gateway when a DataWeave string literal contains Unicode characters outside the Latin-1 range on AMD64 and ARM64 platforms.

W-24090265

W-24119444

The Injection Protection policy no longer incorrectly rejects legitimate multipart SOAP requests with binary attachments when body scanning is enabled.

W-24361237

The JWT Validation policy now accepts RSA keys with padded base64url parameters in JWKS responses.

W-24309516

Control-node replicas now retry concurrent revision updates with backoff instead of failing deployments with a precondition error.

W-24580345

Omni Gateway now preserves component output during shutdown and no longer waits indefinitely when a descendant process keeps output streams open.

W-24129984, W-24141774

These vulnerabilities detected by scanners are now fixed:

CVE-2026-48521
CVE-2026-50572
CVE-2026-73511
CVE-2026-73512
CVE-2026-73513
CVE-2026-73546
CVE-2026-73547
CVE-2026-73548
CVE-2026-73549
CVE-2026-73550
CVE-2026-73551
CVE-2026-73552
CVE-2026-73553

W-24456219, W-24578725

## [](#1-13-6)1.13.6 **September 24, 2026** MuleSoft announces the release of Omni Gateway 1.13.6. ### Fixed Issues

Issue Resolution ID

Updating gateway.configuration through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.

W-23969934

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Log records larger than 32 KB no longer split into separate lines that lose their logging metadata. Oversized records are truncated instead.

W-24055090

Omni Gateway running in Connected Mode no longer sends duplicate runtime logs to Anypoint Platform after logging configuration changes.

W-24037601

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied twice.

W-24195540

W-24268807

The Basic Authentication: LDAP policy no longer includes sensitive authentication data in logs.

W-24118398

These vulnerabilities detected by scanners are now fixed:

CVE-2026-14456
CVE-2026-14457
CVE-2026-18798
CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-5450
CVE-2026-54874
CVE-2026-56853
CVE-2026-56854
CVE-2026-56855
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-5928
CVE-2026-63072
CVE-2026-63073
CVE-2026-63074
CVE-2026-63075
CVE-2026-63076
CVE-2026-75803
CVE-2026-78662
CVE-2026-81870
CVE-2026-81871
CVE-2026-84303
CVE-2026-84304
CVE-2026-84445
GHSA-w67g-5rqw-f597

W-24126253, W-24267883

## [](#1-13-5)1.13.5 **August 27, 2026** MuleSoft announces the release of Omni Gateway 1.13.5. ### Fixed Issues

Issue Resolution ID

Omni Gateway running in Connected Mode no longer disconnects unexpectedly from Anypoint Platform under high-traffic conditions or when the remote server sends data without replying with protocol-level pong frames.

W-23560278

Custom policies no longer crash Omni Gateway with a segmentation fault when a response payload is larger than the buffer limit (1 MB by default). Use the FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES environment variable to increase the buffer limit.

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

Omni Gateway running in Connected Mode no longer sends duplicate deployment-status updates to Anypoint Platform.

W-23862236

The JWT Validation policy no longer bypasses the configured forward proxy when fetching JWKS keys.

W-23840697

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

The Rate Limiting SLA policy with distributed rate limiting enabled no longer crashes the gateway (WASM trap, returning a 503 error instead of 429) under Redis latency and high concurrency on the same SLA tier.

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer return a 503 error on all requests when the exposeHeaders option is enabled and a token claim’s name contains characters that aren’t valid in an HTTP header name.

W-23940967

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

CVE-2022-27943
CVE-2025-27587
CVE-2026-41178
CVE-2026-42767

CVE-2026-56852
CVE-2026-73500
GHSA-259r-337f-4rfw
GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23735964, W-23862957

## [](#1-13-4)1.13.4 **July 23, 2026** MuleSoft announces the release of Omni Gateway 1.13.4. ### Fixed Issues

Issue Resolution ID

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The JSON Threat Protection policy now accepts valid JSON containing an escaped forward slash (\/), per RFC 8259.

W-23510751

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

## [](#1-13-3)1.13.3 **July 8, 2026** MuleSoft announces the release of Omni Gateway 1.13.3. ### What’s New - Envoy is now upgraded to version 1.37.5. ### Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

The readiness probe accuracy is now improved to ensure Omni Gateway only reports as ready when all API configurations are successfully loaded and available for processing traffic. Set --allow-api-errors to false to enable this behavior.

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

SLA tier tracking across authentication policies (Client ID Enforcement, JWT Validation) and Rate Limiting SLA policy is now improved for better analytics and governance.

W-22937088

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

The SOAP Schema Validation policy now correctly processes requests containing nested XOP elements in MTOM payloads

W-21779437

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-45447
CVE-2026-34180
CVE-2026-7383
CVE-2026-45445
CVE-2026-9076
CVE-2026-47774
CVE-2026-47220
CVE-2026-48706

CVE-2026-48042
CVE-2026-48044
CVE-2026-47204
CVE-2026-47221
CVE-2026-48497
CVE-2026-48743
CVE-2026-27145
CVE-2026-42504

W-22698091

## [](#1-13-2)1.13.2 **June 6, 2026** MuleSoft announces the release of Omni Gateway 1.13.2. ### Fixed Issues

Issue Resolution ID

Logging for the flexctl readiness probe is now improved.

W-21615708

The statsEvictionInterval configuration is now added to Envoy bootstrap.

W-22545512

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies now properly populate the authentication.principal property.

W-22696442

The Injection Protection Policy now allows you to apply a policy that uses only custom protections.

W-22491337

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

## [](#1-13-1)1.13.1 **May 20, 2026** MuleSoft announces the release of Omni Gateway 1.13.1. ### Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501
CVE-2026-39817
CVE-2026-39819

CVE-2026-39823
CVE-2026-39825
CVE-2026-39826
GHSA-8rm2-7qqf-34qm
GHSA-wg65-39gg-5wfj
GHSA-fw8g-cg8f-9j28
GHSA-vffh-x6r8-xx99
GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

## [](#1-13-0)1.13.0 **May 11, 2026** MuleSoft announces the release of Omni Gateway 1.13.0. ### What’s New - Flex Gateway is now named to Omni Gateway. Currently, this is a non-breaking change and only cosmetically affects the UI and documentation. This change shouldn’t affect CI/CD pipelines. There are no changes to these areas: - Anypoint Platform CLI - Anypoint Platform APIs - Logging - Environment variables - Documentation URL links - MCP tool names - Omni Gateway now supports GraphQL APIs. To add a GraphQL API to Omni Gateway, see [Adding an Omni Gateway API Instance](https://docs.mulesoft.com/api-manager/latest/create-instance-task-flex). - Omni Gateway now provides these policies to support GraphQL APIs: - [GraphQL Schema Validation](https://docs.mulesoft.com/gateway/latest/policies-included-graphql-schema-validation): Validates incoming GraphQL operations against a GraphQL schema definition - [GraphQL Introspection Control](https://docs.mulesoft.com/gateway/latest/policies-included-graphql-introspection-control): Blocks or allows requests that access the `_schema_`_,_ `type`, and `__typename` GraphQL meta fields - [GraphQL Operation Limits](https://docs.mulesoft.com/gateway/latest/policies-included-graphql-operation-limits): Limits GraphQL operation depth, aliases, root fields, and directives - [GraphQL Static Query Complexity](https://docs.mulesoft.com/gateway/latest/policies-included-graphql-static-query-complexity): Calculates query complexity and blocks requests that exceed the defined budget - Omni Gateway now supports WebSocket APIs. To add a WebSocket API to Omni Gateway, see [Adding an Omni Gateway API Instance](https://docs.mulesoft.com/api-manager/latest/create-instance-task-flex). - Omni Gateway now provides the [WebSocket Connection Limit](https://docs.mulesoft.com/gateway/latest/policies-included-websocket-connection-limit) to limit the number of simultaneous WebSocket connections that each API instance allows. - Omni Gateway is now supported in CloudHub 2.0 shared spaces. To deploy a gateway to a shared space, see [Deploy a Managed Omni Gateway](https://docs.mulesoft.com/gateway/latest/gateway-managed-set-up). - Managed Omni Gateways deployed to CloudHub 2.0 private spaces now provide the **Cluster endpoint** for traffic internal to the cluster to bypass the CloudHub 2.0 ingress. See [Managed Omni Gateway Endpoints](https://docs.mulesoft.com/gateway/latest/gateway-managed-set-up#managed-omni-gateway-endpoints). - MCP Bridge now provides an improved creation experience. See [Adding an MCP Bridge Instance](https://docs.mulesoft.com/api-manager/latest/create-instance-task-mcp-bridge). - Omni Gateway now supports conditional policy application for inbound policies to apply policies to specific methods, URI paths, hosts, and headers. Outbound policies support conditional policy application for specific methods and headers. See [Apply Inbound Omni Gateway Policies](https://docs.mulesoft.com/gateway/latest/gateway-secure-conn#apply-inbound-policy). - Envoy is now upgrade to version 1.37.2. ### Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Contracts are no longer dropped when the client secret is null.	W-21177259
The OAuth 2.0 Token Introspection policy now correctly retrieves contracts when `skip_client_id_validation` is `true`.	W-21371313
Readiness signal errors in the OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies are now fixed.	W-21526778
When `FLEX_DATASOURCE_CONTROL_NODE_ENABLED=true`, Connected Mode Omni Gateway can now scale up if Anypoint is unavailable.	W-22300290
CORS policy now supports wildcard (*) origins.	W-19971117

Contracts are no longer dropped when the client secret is null.

W-21177259

The OAuth 2.0 Token Introspection policy now correctly retrieves contracts when skip_client_id_validation is true.

W-21371313

Readiness signal errors in the OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies are now fixed.

W-21526778

When FLEX_DATASOURCE_CONTROL_NODE_ENABLED=true, Connected Mode Omni Gateway can now scale up if Anypoint is unavailable.

W-22300290

CORS policy now supports wildcard (*) origins.

W-19971117

## [](#1-12-12)1.12.12 **October 23, 2026** MuleSoft announces the release of Omni Gateway 1.12.12. ### What’s New - Custom PDK policies can now access an API instance’s configured consumer URL through `api.consumerUri` in API Context. ### Fixed Issues

Issue Resolution

Omni Gateway now rejects certificates chaining through known compromised eMudhra intermediate certificates.

W-24628768

These vulnerabilities detected by scanners are now fixed:

CVE-2026-35189
CVE-2026-35191
CVE-2026-42772
CVE-2026-54872
CVE-2026-54873
CVE-2026-54875
CVE-2026-72897
CVE-2026-56857
CVE-2026-56866
CVE-2026-78667
CVE-2026-84782

CVE-2026-75804
CVE-2026-75805
CVE-2026-75806
CVE-2026-77696
CVE-2026-84784
CVE-2026-94439
CVE-2026-94440
CVE-2026-94448
CVE-2026-97030
CVE-2026-97031
CVE-2026-111943

W-24624014

## [](#1-12-11)1.12.11 **October 21, 2026** MuleSoft announces the release of Omni Gateway 1.12.11. ### What’s New - The Credential Injection API Key policy now supports DataWeave expressions to resolve the API key from request attributes or payloads at runtime. ### Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Path normalization is now disabled by default. To enable it, set `FLEX_PATH_NORMALIZATION_ENABLED` to `true`.	W-24443266
Omni Gateway now uses `/var/tmp` for temporary files, avoiding failures in containers with a read-only root filesystem.	W-24279051
Helm-generated inbound TLS bindings now apply the correct TLS-context precedence when APIs share a listener.	W-24511699
Omni Gateway no longer crashes during startup in disconnected Runtime Fabric deployments when platform logging, monitoring, or metering endpoints are unavailable.	W-24525793
The Header Injection policy no longer crashes Omni Gateway when a DataWeave string literal contains Unicode characters outside the Latin-1 range on AMD64 and ARM64 platforms.	W-24090265
Control-node replicas now retry concurrent revision updates with backoff instead of failing deployments with a precondition error.	W-24580345
Omni Gateway now preserves component output during shutdown and no longer waits indefinitely when a descendant process keeps output streams open.	W-24129984, W-24141774

Path normalization is now disabled by default. To enable it, set FLEX_PATH_NORMALIZATION_ENABLED to true.

W-24443266

Omni Gateway now uses /var/tmp for temporary files, avoiding failures in containers with a read-only root filesystem.

W-24279051

Helm-generated inbound TLS bindings now apply the correct TLS-context precedence when APIs share a listener.

W-24511699

Omni Gateway no longer crashes during startup in disconnected Runtime Fabric deployments when platform logging, monitoring, or metering endpoints are unavailable.

W-24525793

The Header Injection policy no longer crashes Omni Gateway when a DataWeave string literal contains Unicode characters outside the Latin-1 range on AMD64 and ARM64 platforms.

W-24090265

Control-node replicas now retry concurrent revision updates with backoff instead of failing deployments with a precondition error.

W-24580345

Omni Gateway now preserves component output during shutdown and no longer waits indefinitely when a descendant process keeps output streams open.

W-24129984, W-24141774

## [](#1-12-10)1.12.10 **September 25, 2026** MuleSoft announces the release of Omni Gateway 1.12.10. ### Fixed Issues

Issue Resolution ID

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Omni Gateway no longer splits log entries longer than 8 KB into continuation lines that can be misclassified. Lines up to 32 KB are preserved, and longer lines are truncated and marked.

W-24055090

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.

W-24195540

These vulnerabilities detected by scanners are now fixed:

CVE-2026-14456
CVE-2026-14457
CVE-2026-18798
CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-5450
CVE-2026-54874
CVE-2026-56853
CVE-2026-56854
CVE-2026-56855
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-5928
CVE-2026-63072
CVE-2026-63073
CVE-2026-63074
CVE-2026-63075
CVE-2026-63076
CVE-2026-75803
CVE-2026-78662
CVE-2026-81870
CVE-2026-81871
CVE-2026-84303
CVE-2026-84304
CVE-2026-84445
GHSA-w67g-5rqw-f597

W-24126253, W-24267883

## [](#1-12-9)1.12.9 **August 27, 2026** MuleSoft announces the release of Omni Gateway 1.12.9. ### What’s New - The OpenTelemetry Collector is now upgraded to version 0.158.0. ### Fixed Issues

Issue Resolution ID

W-23560278

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21764662

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

W-23940967

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

CVE-2022-27943
CVE-2025-27587
CVE-2026-41178
CVE-2026-42767

CVE-2026-56852
CVE-2026-73500
GHSA-259r-337f-4rfw
GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23862957

## [](#1-12-8)1.12.8 **July 21, 2026** MuleSoft announces the release of Omni Gateway 1.12.8. ### Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

W-23399906

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

## [](#1-12-7)1.12.7 **June 6, 2026** MuleSoft announces the release of Anypoint Omni Gateway 1.12.7. ### Fixed Issues

Issue Resolution

The principal is no longer always null in the authentication object for OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies.

W-22696442

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

## [](#1-12-6)1.12.6 **May 20, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.6. ### Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

The Injection Protection Policy now allows you to apply a policy that only uses custom protections.

W-22491337

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501
CVE-2026-39817
CVE-2026-39819

CVE-2026-39823
CVE-2026-39825
CVE-2026-39826
GHSA-8rm2-7qqf-34qm
GHSA-wg65-39gg-5wfj
GHSA-fw8g-cg8f-9j28
GHSA-vffh-x6r8-xx99
GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

## [](#1-12-5)1.12.5 **May 7, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.5. ### Fixed Issues

Issue Resolution	ID
MCP and A2A metrics are now reported correctly.	W-22346105
The OAuth 2.0 Token Introspection and OpenID Connect OAuth 2.0 Token Enforcement policies now correctly use the consumer URL for protected resource metadata.	W-22215222

Issue Resolution

MCP and A2A metrics are now reported correctly.

W-22346105

The OAuth 2.0 Token Introspection and OpenID Connect OAuth 2.0 Token Enforcement policies now correctly use the consumer URL for protected resource metadata.

W-22215222

## [](#1-12-4)1.12.4 **April 29, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.4. ### What’s New - Envoy is now updated to version 1.35.10. ### Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-22139443

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-22139443

## [](#1-12-3)1.12.3 **April 22, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.3. ### Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-22028896
The DataWeave `--` operator now correctly removes entries from an object.	W-21643871
The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.	W-22061343
Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.	W-22108203

Vulnerabilities detected by scanners are now fixed.

W-22028896

The DataWeave -- operator now correctly removes entries from an object.

W-21643871

The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.

W-22061343

Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.

W-22108203

## [](#1-12-2)1.12.2 **March 31, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.2. ### What’s New - The [OAuth 2.0 Token Introspection Policy](https://docs.mulesoft.com/gateway/latest/policies-included-oauth-token-introspection) and [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/gateway/latest/policies-included-openid-token-enforcement) now support the OAuth 2.0 discovery flow and parameters required for MCP clients. ### Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-21668427
When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.	W-21471214

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-21668427

When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.

W-21471214

## [](#1-12-1)1.12.1 **March 2, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.1. ### Fixed Issues

Issue Resolution	ID
Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.	W-21361063

Issue Resolution

Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.

W-21361063

## [](#1-12-0)1.12.0 **February 25, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.12.0. ### What’s New - Managed Flex Gateway now supports Runtime Fabric deployments. See [Deploying Managed Flex Gateway on Runtime Fabric](https://docs.mulesoft.com/gateway/latest/gateway-managed-set-up#rtf). - Extra Large Managed Flex Gateway is now available for production purposes with higher throughput and more process demanding policies. To learn more about the performance metrics for Extra Large Managed Flex Gateway, see [Managed Flex Gateway Limits and Performance Metrics](https://docs.mulesoft.com/gateway/latest/review-prerequisites#managed-flex-gateway-limits). - Flex Gateway now supports creating an MCP Bridge to expose API instances as an MCP server. See [Adding an MCP Bridge Instance](https://docs.mulesoft.com/api-manager/latest/create-instance-task-mcp-bridge). - These DataWeave policies are added to modify and filter requests: - [DataWeave Body Transformation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-dataweave-body-transformation): Transforms request or response body content with a DataWeave script - [DataWeave Headers Transformation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-dataweave-headers-transformation): Transforms request or response headers with a DataWeave script - [DataWeave Request Filter Policy](https://docs.mulesoft.com/gateway/latest/policies-included-dataweave-request-filter): Filters requests by using a DataWeave script - A Credential Injection JWT Generation policy is added to generate and inject JWT tokens into outgoing requests. See [Credential Injection JWT Generation Policy](https://docs.mulesoft.com/gateway/latest/policies-outbound-jwt-generation). - A Injection Protection policy is added to scan incoming request headers, path, query string, and body for SQL injection, XSS (Cross-Site Scripting), and custom injection attacks. See [Injection Protection Policy](https://docs.mulesoft.com/gateway/latest/policies-included-injection-protection). - Functionality is added to configure TLS for outgoing HTTP requests from Self-Managed Flex Gateway policies. See [Configuring TLS for Outgoing Policy Requests](https://docs.mulesoft.com/gateway/latest/policies-tls-configuration). - Managed Flex Gateway and Self-Managed Flex Gateway running in Connected Mode now provides the **Runtime Configuration** tab in Runtime Manager to configure and edit logging, tracing, timeouts, circuit breakers, probes, and other runtime properties. - SOAP APIs now support Payloads over 1MB. - Managed Flex Gateway replicas now communicate directly with each other for real-time sharing of HTTP caching and rate limiting data instead of using Object Storage V2. See [Managed Omni Gateway High Availability and Disaster Recovery Deployments](https://docs.mulesoft.com/gateway/latest/gateway-architecture-managed-dr-ha). - Flex Gateway now supports `dw::Core::--` DataWeave functions. See [\-- Functions](https://docs.mulesoft.com/gateway/latest/policies-dataweave-support#available-minus-operators). ### Fixed Issues

Issue Resolution	ID
The SOAP Schema Validation Policy no longer intermittently bypasses validation	W-20173820
Flex Gateway no longer has a usage mismatch when using an HTTP probe.	W-20278837
Flex Gateway now retries to download contracts from Anypoint Platform after failure.	W-20435629
Flex Gateway no longer has temporary request failures during API specification (OAS) updates.	W-20646216
JSON Threat Protection Policy no longer rejects numeric exponential notation.	W-21186984
Vulnerabilities detected by scanners are now fixed.	W-21188054
Flex Gateway no longer loses metric data when A2A and MCP policies are applied.	W-21016899

Issue Resolution

The SOAP Schema Validation Policy no longer intermittently bypasses validation

W-20173820

Flex Gateway no longer has a usage mismatch when using an HTTP probe.

W-20278837

Flex Gateway now retries to download contracts from Anypoint Platform after failure.

W-20435629

Flex Gateway no longer has temporary request failures during API specification (OAS) updates.

W-20646216

JSON Threat Protection Policy no longer rejects numeric exponential notation.

W-21186984

Vulnerabilities detected by scanners are now fixed.

W-21188054

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

## [](#1-9-19)1.9.19 **October 23, 2026** MuleSoft announces the release of Omni Gateway 1.9.19. ### Fixed Issues

Issue Resolution

Omni Gateway now rejects certificates chaining through known compromised eMudhra intermediate certificates.

W-24628768

These vulnerabilities detected by scanners are now fixed:

CVE-2026-42767
CVE-2026-54874
CVE-2026-63072
CVE-2026-63074
CVE-2026-63076
CVE-2026-75803

CVE-2026-78659
CVE-2026-78660
CVE-2026-78663
CVE-2026-78669
CVE-2026-97032
CVE-2026-111943

W-24624014

## [](#1-9-18)1.9.18 **October 21, 2026** MuleSoft announces the release of Omni Gateway 1.9.18. ### Fixed Issues

Issue Resolution ID

Path normalization is now disabled by default. To enable it, set FLEX_PATH_NORMALIZATION_ENABLED to true.

W-24443266

Omni Gateway now uses /var/tmp for temporary files, avoiding failures in containers with a read-only root filesystem.

W-24279051

Helm-generated inbound TLS bindings now apply the correct TLS-context precedence when APIs share a listener.

W-24511699

The Header Injection policy no longer crashes Omni Gateway when a DataWeave string literal contains Unicode characters outside the Latin-1 range on AMD64 and ARM64 platforms.

W-24090265

Control-node replicas now retry concurrent revision updates with backoff instead of failing deployments with a precondition error.

W-24580345

These vulnerabilities detected by scanners are now fixed:

CVE-2026-56857
CVE-2026-56866
CVE-2026-78667
CVE-2026-94439
CVE-2026-94440
CVE-2026-94448
CVE-2026-97030
CVE-2026-97031

W-24578725

## [](#1-9-17)1.9.17 **September 24, 2026** MuleSoft announces the release of Omni Gateway 1.9.17. ### Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Updating `gateway.configuration` through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.	W-23969934
Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.	W-22456427
The `FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE` environment variable now limits filesystem buffering for all Fluent Bit outputs.	W-24062935
Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.	W-24195540

Updating gateway.configuration through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.

W-23969934

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.

W-24195540

## [](#1-9-16)1.9.16 **August 27, 2026** MuleSoft announces the release of Omni Gateway 1.9.16. ### Fixed Issues

Issue Resolution ID

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21764662

W-23399906

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33818
CVE-2026-39821
CVE-2026-41178
CVE-2026-46600
CVE-2026-56852
CVE-2026-56853
CVE-2026-56858

CVE-2026-56859
CVE-2026-56860
CVE-2026-56862
CVE-2026-56864
CVE-2026-56865
CVE-2026-73500
GHSA-hrxh-6v49-42gf

W-23559915, W-23735964, W-23862957

## [](#1-9-15)1.9.15 **July 21, 2026** MuleSoft announces the release of Omni Gateway 1.9.15. ### Fixed Issues

Issue Resolution

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

## [](#1-9-14)1.9.14 **June 6, 2026** MuleSoft announces the release of Anypoint Omni Gateway 1.9.14. ### Fixed Issues

Issue Resolution

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

## [](#1-9-13)1.9.13 **May 20, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.9.13. ### Fixed Issues

Issue Resolution ID

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501

CVE-2026-39817
CVE-2026-39819
CVE-2026-39823
CVE-2026-39825
CVE-2026-39826

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992

## [](#1-9-12)1.9.12 **April 24, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.9.12. ### Fixed Issues

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-22028896

## [](#1-9-11)1.9.11 **March 31, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.9.11. ### Fixed Issues

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-21668427

## [](#1-9-10)1.9.10 **March 5, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.9.10. ### Fixed Issues

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-21259850

Trace configuration now supports setting up a trusted CA.

W-21018187

The JSON Threat Protection policy no longer rejects numeric exponential notation.

W-21186984

The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.

W-20531156

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

## [](#1-9-9)1.9.9 **January 7, 2026** MuleSoft announces the release of Anypoint Flex Gateway 1.9.9. ### Fixed Issues

Issue Resolution

Vulnerabilities detected by scanners are now fixed.

W-20365927

If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.

W-19647107

Flex Gateway now correctly sends logging information to Anypoint Platform.

W-20365743

## [](#1-9-8)1.9.8 **November 13, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.8. ### Fixed Issues

Issue Resolution

Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.

W-20037629

Vulnerabilities detected by scanners are now fixed.

W-20125828

## [](#1-9-7)1.9.7 **October 17, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.7. ### What’s New - For the Rate Limiting and SLA-Based Rate Limiting policies, if distributed rate limiting is enabled, the policy resizes time windows under 10 seconds linearly. For example, if you configure a max of 10 requests per 5 seconds, the policy resizes that window to a max of 20 requests per 10 seconds. See [Rate Limiting: SLA-Based Policy](https://docs.mulesoft.com/gateway/latest/policies-included-rate-limiting-sla) and [Rate Limiting Policy](https://docs.mulesoft.com/gateway/latest/policies-included-rate-limiting). ### Fixed Issues

Issue Resolution

Flex Gateway registration calls from Docker no longer fail for Hyperforce deployments.

W-19444135

Vulnerabilities detected by scanners are now fixed.

W-19787132, W-19971092

The Connected Mode deployment process is now improved.

W-19861373

## [](#1-9-6)1.9.6 **August 26, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.6. ### Fixed Issues

Issue Resolution ID

OAS Schemas are now correctly present in the local configuration cache.

W-18833198

The Envoy agent now properly restarts child processes that end with a core dump or kill signal.

W-19327530

The readiness probe no longer fails when the OAuth Token Introspection policy has skip_client_id_validation enabled.

W-19118057

The readiness probe no longer fails when the OpenID Connect OAuth 2.0 Token Enforcement policy has skip_client_id_validation enabled.

W-19304854

Vulnerabilities detected by scanners are now fixed.

W-19095531, W-19308177

Flex Gateway now validates that there are no collisions when an API base path uses regex expressions.

W-19149269

## [](#1-9-5)1.9.5 **July 2, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.5. ### What’s New - Fluent Bit is now updated to version 3.2.10. ### Fixed Issues

Issue Resolution ID

Flex Gateway no longer ignores the json_date_format Fluent-Bit option.

W-18465012

Vulnerabilities detected by scanners are now fixed.

W-18820570

The Credential Injection OAuth 2.0 policy no longer fails if the expires_in attribute is a string.

W-18779819

The Schema Validation policy now recognizes encoded query params correctly.

W-18883397

## [](#1-9-4)1.9.4 **June 4, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.4. ### Fixed Issues

Issue Resolution

Deploying Flex Gateway with IPv6 disabled no longer causes an error.

W-18671361

## [](#1-9-3)1.9.3 **May 28, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.3. ### What’s New Flex Gateway now supports the Model Context Protocol (MCP) and the Agent2Agent (A2A) Protocol, enabling you to secure, manage, and govern agent interactions: - You can Publish Flex Gateway MCP and A2A Server instances. See [Publishing Omni Gateway Agent and Tool instances](https://docs.mulesoft.com/gateway/latest/agent-publish-apis). - Flex Gateway now includes MCP and A2A policies. Using these new policies, you can: - Protect agent interactions: Require that agents are invoked with appropriate authentication and authorization. - Enhance agent requests: Modify incoming prompts with additional context to improve server agent execution. - Provide centralized oversight: Enable frictionless agent visibility, logging, and insights for debugging and optimization. - Secure connections: Restrict MCP endpoint access to authorized agents only. - Simplify governance: Provide centralized visibility and control over all interactions. - Flex Gateway now includes these policies: A2A Policies: - **A2A Schema Validation**: Verify requests conform to the A2A schema. See [A2A Schema Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-a2a-schema-validation). - **A2A Agent Card**: Proxy the agent through Flex Gateway by rewriting the agent card. See [A2A Agent Card Policy](https://docs.mulesoft.com/gateway/latest/policies-included-a2a-agent-card) - **A2A PII Detector**: Detect sensitive information in messages sent to and from agents. See [A2A Personally Identifiable Information (PII) Detector Policy](https://docs.mulesoft.com/gateway/latest/policies-included-a2a-pii-detector). - **A2A Prompt Decorator**: Modify prompt behavior by injecting custom prompts into requests. See [A2A Prompt Decorator Policy](https://docs.mulesoft.com/gateway/latest/policies-included-a2a-prompt-decorator). - **Server-Sent Events (SSE) Content Logging**: Log content sent by agents for audit and compliance needs. See [SSE Logging Policy](https://docs.mulesoft.com/gateway/latest/policies-included-sse-logging). MCP Policies: - **MCP Schema Validation**: Verify requests conform to the MCP schema. See [MCP Schema Validation Policy](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-schema-validation). - **MCP Support**: Enable MCP support and enable Server-Sent Events (SSE). See [MCP Support Policy](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-support). - **MCP Attribute-Based Access Control**: Allows you to control access to tools, resources, and prompts, based on Cedar expressions. See [MCP Attribute-Based Access Control Policy](https://docs.mulesoft.com/gateway/latest/policies-included-mcp-attribute-access-control). To learn more, see: - [Securing Agent Interactions with Omni Gateway](https://docs.mulesoft.com/gateway/latest/agent-secure). - [API Manager 2.x Release Notes](https://docs.mulesoft.com/release-notes/api-manager/api-manager-release-notes). ## [](#1-9-2)1.9.2 **May 12, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.2. ### Fixed Issues

Issue Resolution

The Flex Gateway 1.9.1 TLS context configuration deployment regression is now fixed.

W-18483362

## [](#1-9-1)1.9.1 **May 8, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.1. ### Fixed Issues

Issue Resolution ID

The onDelete event no longer causes a panic.

W-18368903

The Flex Gateway 1.9.0 ForwardProxy regression is now fixed.

W-18202000

The expires_in attribute in the OAuth credential injection policy is now correctly spelled.

W-18201673

Redis keys no longer collide if multiple Flex Gateways use the same Redis server.

W-18004157

Redeploying one API instance after updating a TLS Context now updates the context for APIs that share the TLS context.

W-17737710

## [](#1-9-0)1.9.0 **March 18, 2025** MuleSoft announces the release of Anypoint Flex Gateway 1.9.0. ### What’s New - Managed Flex Gateway on CloudHub 2.0 Flex Gateway now includes Managed Flex Gateway, a fully hosted version of Flex Gateway on CloudHub 2.0. Managed Flex Gateway provides high availability, autoscaling, less operational overhead, and regular automatic patches and upgrades. **Note:** To use Managed Flex Gateway, ensure the business group you want to deploy your gateway to has Managed Flex Gateway Resources. See [Deploy a Managed Omni Gateway](https://docs.mulesoft.com/gateway/latest/gateway-managed-set-up). - Flex Gateway Version Lifecycle MuleSoft introduces two new release channels, Edge and Long-term Support (LTS). Both release channels are available in all deployment models: Managed Flex Gateway, Self-Managed Flex Gateway Connected Mode, and Self-Managed Flex Gateway Local Mode. Edge releases will be available three times per year, and LTS releases will be available once a year. See [Omni Gateway Version Lifecycle](https://docs.mulesoft.com/gateway/latest/gateway-version-lifecycle). - Outbound Policy Support Outbound policies are policies applied to specific upstreams. To find the new outbound policies, see [Outbound Policies Directory](https://docs.mulesoft.com/gateway/latest/policies-outbound-directory). To apply outbound policies with UI, see [Applying Policies for Managed Omni Gateways and Connected Mode](https://docs.mulesoft.com/gateway/latest/gateway-secure-conn). To apply a policy to a service in Local Mode, see [Secure an API with an Automated Resource-Level Policy](https://docs.mulesoft.com/gateway/latest/local-secure-api-with-auto-policy). - Flex Local Configuration Cache Flex Gateway running in Connected mode can now cache its gateway configuration in shared storage for faster replica initiation, reduced startup times, and accelerated autoscaling. See [Configuring Omni Gateway Configuration Caching in Connected Mode](https://docs.mulesoft.com/gateway/latest/conn-replica-caching). - Flex Scalability Flex Gateway now supports up to 1,000 APIs per gateway. - API Timeouts Flex Gateway now provides the Stream Idle timeout, Response timeout, and Upstream Idle timeout. You can apply the timeouts to the gateway or individual APIs and upstreams as policies. To learn more, see: - [Deploy a Managed Omni Gateway](https://docs.mulesoft.com/gateway/latest/gateway-managed-set-up) - [Configuring Timeouts in Connected Mode](https://docs.mulesoft.com/gateway/latest/conn-timeout) - [Configuring Timeouts in Local Mode](https://docs.mulesoft.com/gateway/latest/local-timeout) ### Fixed Issues

Issue Resolution

When deployed to a Virtual Machine (VM), a Self-Managed Flex Gateway no longer fails to restart after an abrupt stop of the VM.

W-17640917

### Known Issues The [Flex Gateway is unable to send logs when a forward proxy is enabled known issue](https://help.salesforce.com/s/issue?language=en_US&id=a02Ka00000eNiqlIAC) was introduced in Flex Gateway 1.9.0. For more information, see [Salesforce Known Issues](https://help.salesforce.com/s/issues?language=en_US) and set the category to **Mulesoft Flex Gateway**. ## [](#see-also)See Also - [Troubleshooting Omni Gateway](https://docs.mulesoft.com/gateway/latest/troubleshoot) - [Known Issues](https://help.salesforce.com/s/issues)