Contact Us 1-800-596-4880
  1. Homepage
  2. Release Notes

  3. Omni Gateway Release Notes

Omni Gateway Release Notes

These release notes reflect enhancements, changes, and bug fixes for Omni Gateway.

In addition to these release notes, see:

1.14.0

September 2, 2026

MuleSoft announces the release of Omni Gateway 1.14.0.

What’s New

  • The JavaScript Scripting policy is added to run a user-supplied JavaScript module that can inspect and modify requests and responses directly from the gateway.

    See JavaScript Scripting Policy.

  • The GraphQL Access Control policy is added to authorize incoming GraphQL requests by evaluating Cedar-based access-control rules.

    See GraphQL Access Control Policy.

  • Local storage is now file-based instead of in-memory. State used by policies such as Rate Limiting and HTTP Caching are now retained when Omni Gateway is stopped or restarted.

  • Configuration caching (control node) is now enabled by default. The FLEX_DATASOURCE_CONTROL_NODE_ENABLED environment variable now defaults to true. To disable it, set the variable to false.

    See Configuring Omni Gateway Configuration Caching in Connected Mode.

  • The OpenID Connect OAuth 2.0 Token Enforcement policy now exposes the Validated Token TTL (maxFederationExpirationTime) and Maximum Cache Entries (maxCacheSize) settings in Connected Mode to control how long validated tokens are cached and how many entries are stored.

    See OpenID Connect OAuth 2.0 Token Enforcement Policy.

  • The JWT Validation policy now supports OAuth 2.0 Protected Resource Metadata (RFC 9728). When enabled, the policy serves a discovery document at the .well-known/oauth-protected-resource endpoint and adds a resource_metadata hint to the WWW-Authenticate header of 401 responses, so clients can locate the authorization server that protects the API.

    See JWT Validation Policy.

  • The Credential Injection OAuth 2.0 policy now supports adding custom parameters, such as audience, to the OAuth 2.0 token request body.

    See Credential Injection OAuth 2.0 Policy.

  • The Message Logging policy now supports data masking to detect and mask personally identifiable information (PII), such as email addresses, in log messages before they are written. You can select built-in PII types (Email, US SSN, Credit Card, and Phone Number) or add custom regex patterns. Data masking is available for both inbound and outbound message logging, and request and response bodies are forwarded to the upstream service unchanged.

    See Message Logging Policy and Outbound Message Logging Policy.

  • The Schema Validation policy now validates multipart/form-data requests against their OAS schema definitions, in addition to application/json request bodies.

    See Schema Validation Policy.

  • You can now configure the DNS refresh rate for upstream service clusters by setting the FLEX_DNS_REFRESH_RATE environment variable. The value is clamped between 5s and 60s, and defaults to 5s.

  • The flexctl dump CLI command now collects a full snapshot of the gateway’s runtime state into a single ZIP file, including resources, logs, and Envoy statistics. You can write the snapshot to a specific path or stream it to standard output.

    See Troubleshooting with the CLI.

  • The implementation of the DataWeave and SOAP policies is updated to improve policy performance, delivering higher throughput and lower latency.

  • The flexctl check http command now produces curl-style verbose output, logging request and response headers with > and < prefixes and writing the response body to standard output for easier scripting and inspection.

  • Flex Gateway deployments managed by Runtime Fabric for Kubernetes now support pod scheduling customizations (node selectors, tolerations, and affinity rules) defined through a KubernetesTemplate custom resource. Customizations take precedence over the corresponding chart-level settings when both are present.

  • Omni Gateway Docker images are now based on Debian 13 Distroless.

Fixed Issues

Issue Resolution ID

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The WebSocket Connection Limit policy no longer omits rejected connections from the policy violations reported to Anypoint Monitoring.

W-23173354

Flex Gateway no longer rejects valid requests when an API specification (OAS) uses a decimal multipleOf constraint (such as 0.01, 0.001, or 0.1).

W-23192298

Omni Gateway no longer reports as ready when a deployment has failed (for example, when assets could not be downloaded), even when --allow-envoy-errors, --allow-api-errors, or --allow-policy-errors is set to true.

W-23543048

Flex Gateway no longer hangs when its shared storage configuration changes while the gateway is running.

W-23573044

Flex Gateway no longer fails to generate a valid FluentBit log configuration when a label used for log metadata (on the gateway, an API instance, or a service) has an empty value or contains spaces.

W-23147140

Flex Gateway no longer panics when the status and dump endpoints are called before the gateway configuration is fully available during startup.

W-23950422

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-33818

  • CVE-2026-39821

  • CVE-2026-46600

  • CVE-2026-56853

  • CVE-2026-56858

  • CVE-2026-56859

  • CVE-2026-56860

  • CVE-2026-56862

W-22733262

1.13.5

August 27, 2026

MuleSoft announces the release of Omni Gateway 1.13.5.

Fixed Issues

Issue Resolution ID

Omni Gateway running in Connected Mode no longer disconnects unexpectedly from Anypoint Platform under high-traffic conditions or when the remote server sends data without replying with protocol-level pong frames.

W-23560278

Custom policies no longer crash Omni Gateway with a segmentation fault when a response payload is larger than the buffer limit (1 MB by default). Use the FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES environment variable to increase the buffer limit.

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

Omni Gateway running in Connected Mode no longer sends duplicate deployment-status updates to Anypoint Platform.

W-23862236

The JWT Validation policy no longer bypasses the configured forward proxy when fetching JWKS keys.

W-23840697

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

The Rate Limiting SLA policy with distributed rate limiting enabled no longer crashes the gateway (WASM trap, returning a 503 error instead of 429) under Redis latency and high concurrency on the same SLA tier.

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer return a 503 error on all requests when the exposeHeaders option is enabled and a token claim’s name contains characters that aren’t valid in an HTTP header name.

W-23940967

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

  • CVE-2022-27943

  • CVE-2025-27587

  • CVE-2026-41178

  • CVE-2026-42767

  • CVE-2026-56852

  • CVE-2026-73500

  • GHSA-259r-337f-4rfw

  • GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23735964, W-23862957

1.13.4

July 23, 2026

MuleSoft announces the release of Omni Gateway 1.13.4.

Fixed Issues

Issue Resolution ID

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The JSON Threat Protection policy now accepts valid JSON containing an escaped forward slash (\/), per RFC 8259.

W-23510751

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-34182

  • CVE-2026-34180

  • CVE-2026-45445

  • CVE-2026-45447

  • CVE-2026-7383

  • CVE-2026-9076

  • CVE-2026-39822

  • CVE-2026-42504

  • CVE-2026-27145

  • CVE-2026-42766

  • CVE-2026-45446

  • CVE-2026-42505

  • CVE-2026-42507

  • CVE-2026-42770

W-22698091

1.13.3

July 8, 2026

MuleSoft announces the release of Omni Gateway 1.13.3.

What’s New

  • Envoy is now upgraded to version 1.37.5.

Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

The readiness probe accuracy is now improved to ensure Omni Gateway only reports as ready when all API configurations are successfully loaded and available for processing traffic. Set --allow-api-errors to false to enable this behavior.

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

SLA tier tracking across authentication policies (Client ID Enforcement, JWT Validation) and Rate Limiting SLA policy is now improved for better analytics and governance.

W-22937088

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

The SOAP Schema Validation policy now correctly processes requests containing nested XOP elements in MTOM payloads

W-21779437

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-34182

  • CVE-2026-45447

  • CVE-2026-34180

  • CVE-2026-7383

  • CVE-2026-45445

  • CVE-2026-9076

  • CVE-2026-47774

  • CVE-2026-47220

  • CVE-2026-48706

  • CVE-2026-48042

  • CVE-2026-48044

  • CVE-2026-47204

  • CVE-2026-47221

  • CVE-2026-48497

  • CVE-2026-48743

  • CVE-2026-27145

  • CVE-2026-42504

W-22698091

1.13.2

June 6, 2026

MuleSoft announces the release of Omni Gateway 1.13.2.

Fixed Issues

Issue Resolution ID

Logging for the flexctl readiness probe is now improved.

W-21615708

The statsEvictionInterval configuration is now added to Envoy bootstrap.

W-22545512

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies now properly populate the authentication.principal property.

W-22696442

The Injection Protection Policy now allows you to apply a policy that uses only custom protections.

W-22491337

These vulnerabilities detected by scanners are now fixed:

  • VE-2025-15281

  • CVE-2026-0861

  • CVE-2026-0915

  • CVE-2026-25680

  • CVE-2026-25681

  • CVE-2026-27136

  • CVE-2026-32952

  • CVE-2026-33814

  • CVE-2026-39821

  • CVE-2026-39824

  • CVE-2026-39827

  • CVE-2026-39828

  • CVE-2026-39829

  • CVE-2026-39830

  • CVE-2026-39831

  • CVE-2026-39832

  • CVE-2026-39833

  • CVE-2026-39834

  • CVE-2026-39835

  • CVE-2026-4046

  • CVE-2026-42502

  • CVE-2026-42506

  • CVE-2026-42508

  • CVE-2026-4437

  • CVE-2026-4438

  • CVE-2026-46595

  • CVE-2026-46597

  • CVE-2026-46598

  • CVE-2026-4878

W-22698091

1.13.1

May 20, 2026

MuleSoft announces the release of Omni Gateway 1.13.1.

Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-33811

  • CVE-2026-33814

  • CVE-2026-39820

  • CVE-2026-39836

  • CVE-2026-42499

  • CVE-2026-42501

  • CVE-2026-39817

  • CVE-2026-39819

  • CVE-2026-39823

  • CVE-2026-39825

  • CVE-2026-39826

  • GHSA-8rm2-7qqf-34qm

  • GHSA-wg65-39gg-5wfj

  • GHSA-fw8g-cg8f-9j28

  • GHSA-vffh-x6r8-xx99

  • GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

1.13.0

May 11, 2026

MuleSoft announces the release of Omni Gateway 1.13.0.

What’s New

  • Flex Gateway is now named to Omni Gateway.

    Currently, this is a non-breaking change and only cosmetically affects the UI and documentation. This change shouldn’t affect CI/CD pipelines. There are no changes to these areas:

    • Anypoint Platform CLI

    • Anypoint Platform APIs

    • Logging

    • Environment variables

    • Documentation URL links

    • MCP tool names

  • Omni Gateway now supports GraphQL APIs.

    To add a GraphQL API to Omni Gateway, see Adding an Omni Gateway API Instance.

  • Omni Gateway now provides these policies to support GraphQL APIs:

  • Omni Gateway now supports WebSocket APIs.

    To add a WebSocket API to Omni Gateway, see Adding an Omni Gateway API Instance.

  • Omni Gateway now provides the WebSocket Connection Limit to limit the number of simultaneous WebSocket connections that each API instance allows.

  • Omni Gateway is now supported in CloudHub 2.0 shared spaces.

    To deploy a gateway to a shared space, see Deploy a Managed Omni Gateway.

  • Managed Omni Gateways deployed to CloudHub 2.0 private spaces now provide the Cluster endpoint for traffic internal to the cluster to bypass the CloudHub 2.0 ingress.

    See Managed Omni Gateway Endpoints.

  • MCP Bridge now provides an improved creation experience.

    See Adding an MCP Bridge Instance.

  • Omni Gateway now supports conditional policy application for inbound policies to apply policies to specific methods, URI paths, hosts, and headers. Outbound policies support conditional policy application for specific methods and headers.

    See Apply Inbound Omni Gateway Policies.

  • Envoy is now upgrade to version 1.37.2.

Fixed Issues

Issue Resolution ID

Contracts are no longer dropped when the client secret is null.

W-21177259

The OAuth 2.0 Token Introspection policy now correctly retrieves contracts when skip_client_id_validation is true.

W-21371313

Readiness signal errors in the OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies are now fixed.

W-21526778

When FLEX_DATASOURCE_CONTROL_NODE_ENABLED=true, Connected Mode Omni Gateway can now scale up if Anypoint is unavailable.

W-22300290

CORS policy now supports wildcard (*) origins.

W-19971117

1.12.9

August 27, 2026

MuleSoft announces the release of Omni Gateway 1.12.9.

What’s New

  • The OpenTelemetry Collector is now upgraded to version 0.158.0.

Fixed Issues

Issue Resolution ID

Omni Gateway running in Connected Mode no longer disconnects unexpectedly from Anypoint Platform under high-traffic conditions or when the remote server sends data without replying with protocol-level pong frames.

W-23560278

Custom policies no longer crash Omni Gateway with a segmentation fault when a response payload is larger than the buffer limit (1 MB by default). Use the FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES environment variable to increase the buffer limit.

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21764662

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

The Rate Limiting SLA policy with distributed rate limiting enabled no longer crashes the gateway (WASM trap, returning a 503 error instead of 429) under Redis latency and high concurrency on the same SLA tier.

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer return a 503 error on all requests when the exposeHeaders option is enabled and a token claim’s name contains characters that aren’t valid in an HTTP header name.

W-23940967

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

  • CVE-2022-27943

  • CVE-2025-27587

  • CVE-2026-41178

  • CVE-2026-42767

  • CVE-2026-56852

  • CVE-2026-73500

  • GHSA-259r-337f-4rfw

  • GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23862957

1.12.8

July 21, 2026

MuleSoft announces the release of Omni Gateway 1.12.8.

Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

The readiness probe accuracy is now improved to ensure Omni Gateway only reports as ready when all API configurations are successfully loaded and available for processing traffic. Set --allow-api-errors to false to enable this behavior.

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-34182

  • CVE-2026-34180

  • CVE-2026-45445

  • CVE-2026-45447

  • CVE-2026-7383

  • CVE-2026-9076

  • CVE-2026-39822

  • CVE-2026-42504

  • CVE-2026-27145

  • CVE-2026-42766

  • CVE-2026-45446

  • CVE-2026-42505

  • CVE-2026-42507

  • CVE-2026-42770

W-22698091

1.12.7

June 6, 2026

MuleSoft announces the release of Anypoint Omni Gateway 1.12.7.

Fixed Issues

Issue Resolution ID

The principal is no longer always null in the authentication object for OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies.

W-22696442

These vulnerabilities detected by scanners are now fixed:

  • VE-2025-15281

  • CVE-2026-0861

  • CVE-2026-0915

  • CVE-2026-25680

  • CVE-2026-25681

  • CVE-2026-27136

  • CVE-2026-32952

  • CVE-2026-33814

  • CVE-2026-39821

  • CVE-2026-39824

  • CVE-2026-39827

  • CVE-2026-39828

  • CVE-2026-39829

  • CVE-2026-39830

  • CVE-2026-39831

  • CVE-2026-39832

  • CVE-2026-39833

  • CVE-2026-39834

  • CVE-2026-39835

  • CVE-2026-4046

  • CVE-2026-42502

  • CVE-2026-42506

  • CVE-2026-42508

  • CVE-2026-4437

  • CVE-2026-4438

  • CVE-2026-46595

  • CVE-2026-46597

  • CVE-2026-46598

  • CVE-2026-4878

W-22698091

1.12.6

May 20, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.6.

Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

The Injection Protection Policy now allows you to apply a policy that only uses custom protections.

W-22491337

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-33811

  • CVE-2026-33814

  • CVE-2026-39820

  • CVE-2026-39836

  • CVE-2026-42499

  • CVE-2026-42501

  • CVE-2026-39817

  • CVE-2026-39819

  • CVE-2026-39823

  • CVE-2026-39825

  • CVE-2026-39826

  • GHSA-8rm2-7qqf-34qm

  • GHSA-wg65-39gg-5wfj

  • GHSA-fw8g-cg8f-9j28

  • GHSA-vffh-x6r8-xx99

  • GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

1.12.5

May 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.5.

Fixed Issues

Issue Resolution ID

MCP and A2A metrics are now reported correctly.

W-22346105

The OAuth 2.0 Token Introspection and OpenID Connect OAuth 2.0 Token Enforcement policies now correctly use the consumer URL for protected resource metadata.

W-22215222

1.12.4

April 29, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.4.

What’s New

  • Envoy is now updated to version 1.35.10.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22139443

1.12.3

April 22, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.3.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

The DataWeave -- operator now correctly removes entries from an object.

W-21643871

The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.

W-22061343

Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.

W-22108203

1.12.2

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.2.

What’s New

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.

W-21471214

1.12.1

March 2, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.1.

Fixed Issues

Issue Resolution ID

Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.

W-21361063

1.12.0

February 25, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.0.

What’s New

Fixed Issues

Issue Resolution ID

The SOAP Schema Validation Policy no longer intermittently bypasses validation

W-20173820

Flex Gateway no longer has a usage mismatch when using an HTTP probe.

W-20278837

Flex Gateway now retries to download contracts from Anypoint Platform after failure.

W-20435629

Flex Gateway no longer has temporary request failures during API specification (OAS) updates.

W-20646216

JSON Threat Protection Policy no longer rejects numeric exponential notation.

W-21186984

Vulnerabilities detected by scanners are now fixed.

W-21188054

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.9.15

July 21, 2026

MuleSoft announces the release of Omni Gateway 1.9.15.

Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-34182

  • CVE-2026-34180

  • CVE-2026-45445

  • CVE-2026-45447

  • CVE-2026-7383

  • CVE-2026-9076

  • CVE-2026-39822

  • CVE-2026-42504

  • CVE-2026-27145

  • CVE-2026-42766

  • CVE-2026-45446

  • CVE-2026-42505

  • CVE-2026-42507

  • CVE-2026-42770

W-22698091

1.9.14

June 6, 2026

MuleSoft announces the release of Anypoint Omni Gateway 1.9.14.

Fixed Issues

Issue Resolution ID

These vulnerabilities detected by scanners are now fixed:

  • VE-2025-15281

  • CVE-2026-0861

  • CVE-2026-0915

  • CVE-2026-25680

  • CVE-2026-25681

  • CVE-2026-27136

  • CVE-2026-32952

  • CVE-2026-33814

  • CVE-2026-39821

  • CVE-2026-39824

  • CVE-2026-39827

  • CVE-2026-39828

  • CVE-2026-39829

  • CVE-2026-39830

  • CVE-2026-39831

  • CVE-2026-39832

  • CVE-2026-39833

  • CVE-2026-39834

  • CVE-2026-39835

  • CVE-2026-4046

  • CVE-2026-42502

  • CVE-2026-42506

  • CVE-2026-42508

  • CVE-2026-4437

  • CVE-2026-4438

  • CVE-2026-46595

  • CVE-2026-46597

  • CVE-2026-46598

  • CVE-2026-4878

W-22698091

1.9.13

May 20, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.13.

Fixed Issues

Issue Resolution ID

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

These vulnerabilities detected by scanners are now fixed:

  • CVE-2026-33811

  • CVE-2026-33814

  • CVE-2026-39820

  • CVE-2026-39836

  • CVE-2026-42499

  • CVE-2026-42501

  • CVE-2026-39817

  • CVE-2026-39819

  • CVE-2026-39823

  • CVE-2026-39825

  • CVE-2026-39826

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992

1.9.12

April 24, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.12.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

1.9.11

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.11.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

1.9.10

March 5, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.10.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-21259850

Trace configuration now supports setting up a trusted CA.

W-21018187

The JSON Threat Protection policy no longer rejects numeric exponential notation.

W-21186984

The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.

W-20531156

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.9.9

January 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.9.

Fixed Issues

Issue Resolution ID

Vulnerabilities detected by scanners are now fixed.

W-20365927

If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.

W-19647107

Flex Gateway now correctly sends logging information to Anypoint Platform.

W-20365743

1.9.8

November 13, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.8.

Fixed Issues

Issue Resolution ID

Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.

W-20037629

Vulnerabilities detected by scanners are now fixed.

W-20125828

1.9.7

October 17, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.7.

What’s New

  • For the Rate Limiting and SLA-Based Rate Limiting policies, if distributed rate limiting is enabled, the policy resizes time windows under 10 seconds linearly. For example, if you configure a max of 10 requests per 5 seconds, the policy resizes that window to a max of 20 requests per 10 seconds.

    See Rate Limiting: SLA-Based Policy and Rate Limiting Policy.

Fixed Issues

Issue Resolution ID

Flex Gateway registration calls from Docker no longer fail for Hyperforce deployments.

W-19444135

Vulnerabilities detected by scanners are now fixed.

W-19787132, W-19971092

The Connected Mode deployment process is now improved.

W-19861373

1.9.6

August 26, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.6.

Fixed Issues

Issue Resolution ID

OAS Schemas are now correctly present in the local configuration cache.

W-18833198

The Envoy agent now properly restarts child processes that end with a core dump or kill signal.

W-19327530

The readiness probe no longer fails when the OAuth Token Introspection policy has skip_client_id_validation enabled.

W-19118057

The readiness probe no longer fails when the OpenID Connect OAuth 2.0 Token Enforcement policy has skip_client_id_validation enabled.

W-19304854

Vulnerabilities detected by scanners are now fixed.

W-19095531, W-19308177

Flex Gateway now validates that there are no collisions when an API base path uses regex expressions.

W-19149269

1.9.5

July 2, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.5.

What’s New

  • Fluent Bit is now updated to version 3.2.10.

Fixed Issues

Issue Resolution ID

Flex Gateway no longer ignores the json_date_format Fluent-Bit option.

W-18465012

Vulnerabilities detected by scanners are now fixed.

W-18820570

The Credential Injection OAuth 2.0 policy no longer fails if the expires_in attribute is a string.

W-18779819

The Schema Validation policy now recognizes encoded query params correctly.

W-18883397

1.9.4

June 4, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.4.

Fixed Issues

Issue Resolution ID

Deploying Flex Gateway with IPv6 disabled no longer causes an error.

W-18671361

1.9.3

May 28, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.3.

What’s New

Flex Gateway now supports the Model Context Protocol (MCP) and the Agent2Agent (A2A) Protocol, enabling you to secure, manage, and govern agent interactions:

  • You can Publish Flex Gateway MCP and A2A Server instances.

    See Publishing Omni Gateway Agent and Tool instances.

  • Flex Gateway now includes MCP and A2A policies. Using these new policies, you can:

    • Protect agent interactions: Require that agents are invoked with appropriate authentication and authorization.

    • Enhance agent requests: Modify incoming prompts with additional context to improve server agent execution.

    • Provide centralized oversight: Enable frictionless agent visibility, logging, and insights for debugging and optimization.

    • Secure connections: Restrict MCP endpoint access to authorized agents only.

    • Simplify governance: Provide centralized visibility and control over all interactions.

  • Flex Gateway now includes these policies:

    A2A Policies:

    MCP Policies:

To learn more, see:

1.9.2

May 12, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.2.

Fixed Issues

Issue Resolution ID

The Flex Gateway 1.9.1 TLS context configuration deployment regression is now fixed.

W-18483362

1.9.1

May 8, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.1.

Fixed Issues

Issue Resolution ID

The onDelete event no longer causes a panic.

W-18368903

The Flex Gateway 1.9.0 ForwardProxy regression is now fixed.

W-18202000

The expires_in attribute in the OAuth credential injection policy is now correctly spelled.

W-18201673

Redis keys no longer collide if multiple Flex Gateways use the same Redis server.

W-18004157

Redeploying one API instance after updating a TLS Context now updates the context for APIs that share the TLS context.

W-17737710

1.9.0

March 18, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.0.

What’s New

  • Managed Flex Gateway on CloudHub 2.0

    Flex Gateway now includes Managed Flex Gateway, a fully hosted version of Flex Gateway on CloudHub 2.0. Managed Flex Gateway provides high availability, autoscaling, less operational overhead, and regular automatic patches and upgrades.

    Note: To use Managed Flex Gateway, ensure the business group you want to deploy your gateway to has Managed Flex Gateway Resources.

    See Deploy a Managed Omni Gateway.

  • Flex Gateway Version Lifecycle

    MuleSoft introduces two new release channels, Edge and Long-term Support (LTS). Both release channels are available in all deployment models: Managed Flex Gateway, Self-Managed Flex Gateway Connected Mode, and Self-Managed Flex Gateway Local Mode. Edge releases will be available three times per year, and LTS releases will be available once a year.

    See Omni Gateway Version Lifecycle.

  • Outbound Policy Support

    Outbound policies are policies applied to specific upstreams. To find the new outbound policies, see Outbound Policies Directory.

    To apply outbound policies with UI, see Applying Policies for Managed Omni Gateways and Connected Mode. To apply a policy to a service in Local Mode, see Secure an API with an Automated Resource-Level Policy.

  • Flex Local Configuration Cache

    Flex Gateway running in Connected mode can now cache its gateway configuration in shared storage for faster replica initiation, reduced startup times, and accelerated autoscaling.

    See Configuring Omni Gateway Configuration Caching in Connected Mode.

  • Flex Scalability

    Flex Gateway now supports up to 1,000 APIs per gateway.

  • API Timeouts

    Flex Gateway now provides the Stream Idle timeout, Response timeout, and Upstream Idle timeout. You can apply the timeouts to the gateway or individual APIs and upstreams as policies. To learn more, see:

Fixed Issues

Issue Resolution ID

When deployed to a Virtual Machine (VM), a Self-Managed Flex Gateway no longer fails to restart after an abrupt stop of the VM.

W-17640917

Known Issues

The Flex Gateway is unable to send logs when a forward proxy is enabled known issue was introduced in Flex Gateway 1.9.0.

For more information, see Salesforce Known Issues and set the category to Mulesoft Flex Gateway.

See Also