Contact Us 1-800-596-4880

Anypoint Flex Gateway Release Notes

These release notes reflect enhancements, changes, and bug fixes for Anypoint Flex Gateway.

In addition to these release notes, see:

1.12.4

April 29, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.4.

What’s New

  • Envoy is now updated to version 1.35.10.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22139443

1.12.3

April 22, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.3.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

The DataWeave -- operator now correctly removes entries from an object.

W-21643871

The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.

W-22061343

Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.

W-22108203

1.12.2

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.2.

What’s New

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.

W-21471214

1.12.1

March 2, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.1.

Fixed Issues

Issue Resolution ID

Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.

W-21361063

1.12.0

February 25, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.0.

What’s New

Fixed Issues

Issue Resolution ID

The SOAP Schema Validation Policy no longer intermittently bypasses validation

W-20173820

Flex Gateway no longer has a usage mismatch when using an HTTP probe.

W-20278837

Flex Gateway now retries to download contracts from Anypoint Platform after failure.

W-20435629

Flex Gateway no longer has temporary request failures during API specification (OAS) updates.

W-20646216

JSON Threat Protection Policy no longer rejects numeric exponential notation.

W-21186984

Vulnerabilities detected by scanners are now fixed.

W-21188054

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.11.8

April 29, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.8.

What’s New

  • Envoy is now updated to version 1.35.10.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22139443

1.11.7

This version of the product has entered Extended Support.

April 24, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.7.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

1.11.6

This version of the product has entered Extended Support.

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.6.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

1.11.5

This version of the product has entered Extended Support.

March 5, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.5.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21259850

Trace configuration now supports a trusted CA.

W-21018187

The JSON Threat Protection policy no longer rejects numeric exponential notation.

W-21186984

Flex Gateway no longer has temporary request failures during API specification (OAS) updates.

W-20646216

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.11.4

This version of the product has entered Extended Support.

January 15, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.4.

What’s New

  • Envoy is now updated to version 1.35.3.

Fixed Issues

Issue Resolution ID

The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.

W-20531156

Vulnerabilities detected by scanners are now fixed.

W-20911125

1.11.3

This version of the product has entered Extended Support.

January 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.11.3.

What’s New

  • The Credential Injection OAuth 2.0 policy now provides the Credential location parameter to specify where the OAuth 2.0 credentials are located in the request.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-20365927

If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.

W-19647107

Flex Gateway Open Telemetry INFO level logging is now less verbose.

W-20209998

Flex Gateway now correctly sends logging information to Anypoint Platform.

W-20365743

When caching a Flex Gateway configuration, the deployment deletion command now functions properly.

W-20510685

Flex Gateway now properly handles log lines longer than 64kb.

W-20510872

1.11.2

This version of the product has entered Extended Support.

November 13, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.11.2.

Fixed Issues

Issue Resolution ID

Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.

W-20037629

Vulnerabilities detected by scanners are now fixed.

W-20125828

The OpenID Connect OAuth 2.0 Token Enforcement policy no longer fails when Microsoft Entra ID is the identity provider.

W-20129783

1.11.1

This version of the product has entered Extended Support.

October 22, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.11.1.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-19971092

Envoy was downgraded to 1.34.0 to fix a segmentation fault error.

W-19979621

1.11.0

This version of the product has entered Extended Support.

October 13, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.11.0.

What’s New

  • Envoy is now updated to version 1.35.3.

  • TLS 1.1 support is removed for enhanced security compliance.

  • Flex Gateway now provides the outbound AWS Signature policy to inject client credentials into upstream requests.

  • Flex Gateway now provides the outbound Message Logging policy to configure message logging specific to upstream servers.

  • Flex Gateway Envoy Spawn Upstream Span tracing mode is now turned on for improved observability.

  • The Credential Injection OAuth 2.0 policy now provides additional configuration options to support a wider range of OAuth 2.0 providers.

  • You can now preserve the X-Request-ID header by setting the FLEX_PRESERVE_EXTERNAL_REQUEST_ID environment variable to true.

  • An API context now includes the SLA tier Name.

  • Flex Gateway now supports regex negative lookahead using the (?!) syntax.

  • Flex Gateway now restarts policies if the policy causes a panic.

  • The SLA ID and SLA name are now included in the Authentication context for better SLA tracking.

  • The Basic Authentication: LDAP Policy now provides the authorizationExpression DataWeave parameter to extract a custom authorization token.

  • Flex Gateway now provides the flexctl registration delete command to delete the Flex Gateway registration from Anypoint Platform to free resources. The delete command doesn’t delete the registration.yaml file.

  • You can now add authentication certificates to a Flex Gateway tracing configuration

  • RTF metering data is now exported for better resource monitoring.

  • Flex Gateway running in Connected Mode now supports storing contracts in shared storage for improved contract management.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-19787132

The OpenID Connect OAuth 2.0 Token Enforcement policy configured with Microsoft Entra ID no longer causes rate-limiting errors.

W-19560760

The Schema Validation policy no longer causes errors when the OAS specification contains nullable fields.

W-19556646

The Connected Mode deployment process is now improved.

W-19861373

1.9.12

April 24, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.12.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

1.9.11

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.11.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

1.9.10

March 5, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.10.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21259850

Trace configuration now supports setting up a trusted CA.

W-21018187

The JSON Threat Protection policy no longer rejects numeric exponential notation.

W-21186984

The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.

W-20531156

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.9.9

January 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.9.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-20365927

If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.

W-19647107

Flex Gateway now correctly sends logging information to Anypoint Platform.

W-20365743

1.9.8

November 13, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.8.

Fixed Issues

Issue Resolution ID

Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.

W-20037629

Vulnerabilities detected by scanners are now fixed.

W-20125828

1.9.7

October 17, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.7.

What’s New

  • For the Rate Limiting and SLA-Based Rate Limiting policies, if distributed rate limiting is enabled, the policy resizes time windows under 10 seconds linearly. For example, if you configure a max of 10 requests per 5 seconds, the policy resizes that window to a max of 20 requests per 10 seconds.

Fixed Issues

Issue Resolution ID

Flex Gateway registration calls from Docker no longer fail for Hyperforce deployments.

W-19444135

Vulnerabilities detected by scanners are now fixed.

W-19787132, W-19971092

The Connected Mode deployment process is now improved.

W-19861373

1.9.6

August 26, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.6.

Fixed Issues

Issue Resolution ID

OAS Schemas are now correctly present in the local configuration cache.

W-18833198

The Envoy agent now properly restarts child processes that end with a core dump or kill signal.

W-19327530

The readiness probe no longer fails when the OAuth Token Introspection policy has skip_client_id_validation enabled.

W-19118057

The readiness probe no longer fails when the OpenID Connect OAuth 2.0 Token Enforcement policy has skip_client_id_validation enabled.

W-19304854

Vulnerabilities detected by scanners are now fixed.

W-19095531, W-19308177

Flex Gateway now validates that there are no collisions when an API base path uses regex expressions.

W-19149269

1.9.5

July 2, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.5.

What’s New

  • Fluent Bit is now updated to version 3.2.10.

Fixed Issues

Issue Resolution ID

Flex Gateway no longer ignores the json_date_format Fluent-Bit option.

W-18465012

Vulnerabilities detected by scanners are now fixed.

W-18820570

The Credential Injection OAuth 2.0 policy no longer fails if the expires_in attribute is a string.

W-18779819

The Schema Validation policy now recognizes encoded query params correctly.

W-18883397

1.9.4

June 4, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.4.

Fixed Issues

Issue Resolution ID

Deploying Flex Gateway with IPv6 disabled no longer causes an error.

W-18671361

1.9.3

May 28, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.3.

What’s New

Flex Gateway now supports the Model Context Protocol (MCP) and the Agent2Agent (A2A) Protocol, enabling you to secure, manage, and govern agent interactions:

  • You can Publish Flex Gateway MCP and A2A Server instances.

  • Flex Gateway now includes MCP and A2A policies. Using these new policies, you can:

    • Protect agent interactions: Require that agents are invoked with appropriate authentication and authorization.

    • Enhance agent requests: Modify incoming prompts with additional context to improve server agent execution.

    • Provide centralized oversight: Enable frictionless agent visibility, logging, and insights for debugging and optimization.

    • Secure connections: Restrict MCP endpoint access to authorized agents only.

    • Simplify governance: Provide centralized visibility and control over all interactions.

  • Flex Gateway now includes these policies:

    A2A Policies:

    MCP Policies:

To learn more, see:

1.9.2

May 12, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.2.

Fixed Issues

Issue Resolution ID

The Flex Gateway 1.9.1 TLS context configuration deployment regression is now fixed.

W-18483362

1.9.1

May 8, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.1.

Fixed Issues

Issue Resolution ID

The onDelete event no longer causes a panic.

W-18368903

The Flex Gateway 1.9.0 ForwardProxy regression is now fixed.

W-18202000

The expires_in attribute in the OAuth credential injection policy is now correctly spelled.

W-18201673

Redis keys no longer collide if multiple Flex Gateways use the same Redis server.

W-18004157

Redeploying one API instance after updating a TLS Context now updates the context for APIs that share the TLS context.

W-17737710

1.9.0

March 18, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.0.

What’s New

  • Managed Flex Gateway on CloudHub 2.0

    Flex Gateway now includes Managed Flex Gateway, a fully hosted version of Flex Gateway on CloudHub 2.0. Managed Flex Gateway provides high availability, autoscaling, less operational overhead, and regular automatic patches and upgrades.

    Note: To use Managed Flex Gateway, ensure the business group you want to deploy your gateway to has Managed Flex Gateway Resources.

  • Flex Gateway Version Lifecycle

    MuleSoft introduces two new release channels, Edge and Long-term Support (LTS). Both release channels are available in all deployment models: Managed Flex Gateway, Self-Managed Flex Gateway Connected Mode, and Self-Managed Flex Gateway Local Mode. Edge releases will be available three times per year, and LTS releases will be available once a year.

  • Outbound Policy Support

    Outbound policies are policies applied to specific upstreams. To find the new outbound policies, see Outbound Policies Directory.

    To apply outbound policies with UI, see Applying Policies for Managed Flex Gateways and Connected Mode. To apply a policy to a service in Local Mode, see Secure an API with an Automated Resource-Level Policy.

  • Flex Local Configuration Cache

    Flex Gateway running in Connected mode can now cache its gateway configuration in shared storage for faster replica initiation, reduced startup times, and accelerated autoscaling.

  • Flex Scalability

    Flex Gateway now supports up to 1,000 APIs per gateway.

  • API Timeouts

    Flex Gateway now provides the Stream Idle timeout, Response timeout, and Upstream Idle timeout. You can apply the timeouts to the gateway or individual APIs and upstreams as policies. To learn more, see:

Fixed Issues

Issue Resolution ID

When deployed to a Virtual Machine (VM), a Self-Managed Flex Gateway no longer fails to restart after an abrupt stop of the VM.

W-17640917

Known Issues

For more information, see Salesforce Known Issues and set the category to Mulesoft Flex Gateway.