Omni Gateway Release Notes | MuleSoft Documentation

1.14.2

October 1, 2026

MuleSoft announces the release of Omni Gateway 1.14.2.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
The JWT Validation, OpenID Connect OAuth 2.0 Token Enforcement, and OAuth 2.0 Token Introspection policies now preserve path segments and trailing slashes from consumer URLs when generating protected resource metadata URLs.	W-24119444
Omni Gateway now preserves percent-encoded reserved characters, such as `%2F` and `%3A`, in upstream URL paths when forwarding requests to backend services.	W-24135806
Per-API message logs in API Manager now populate correctly for Omni Gateway registrations that use v1 URLs.	W-24332213

The JWT Validation, OpenID Connect OAuth 2.0 Token Enforcement, and OAuth 2.0 Token Introspection policies now preserve path segments and trailing slashes from consumer URLs when generating protected resource metadata URLs.

W-24119444

Omni Gateway now preserves percent-encoded reserved characters, such as %2F and %3A, in upstream URL paths when forwarding requests to backend services.

W-24135806

Per-API message logs in API Manager now populate correctly for Omni Gateway registrations that use v1 URLs.

W-24332213

1.14.1

September 25, 2026

MuleSoft announces the release of Omni Gateway 1.14.1.

What’s New

Managed Omni Gateway deployments on Runtime Fabric now support forward proxy configuration.
Configuration resources now support environment variable expansion in string and scalar values.
Self-Managed Omni Gateway can now internally rewrite requests that exactly match a configured slashless API base path, such as /api, to its slash-terminated form (/api/). Set FLEX_BASE_PATH_CANONICALIZER_ENABLED to true to enable this behavior.
The Message Logging policy now supports masking regex capture groups while preserving the rest of the matched value.

Fixed Issues

Issue Resolution ID

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

Log records larger than 32 KB no longer split into separate lines that lose their logging metadata. Oversized records are truncated instead.

W-24055090

Omni Gateway running in Connected Mode no longer sends duplicate runtime logs to Anypoint Platform after logging configuration changes.

W-24037601

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied twice.

W-24195540

The Basic Authentication: LDAP policy no longer includes sensitive authentication data in logs.

W-24118398

The OpenID Connect OAuth 2.0 Token Enforcement policy now correctly applies defaultTLS.outboundPolicyCalls to identity-provider token requests without applying those settings to Anypoint Platform connections.

W-24268807

Tracing now preserves custom server span names without forwarding the x-envoy-decorator-operation header to upstream services. Upstream-only span tags no longer appear on server spans.

W-23923463

These vulnerabilities detected by scanners are now fixed:

CVE-2026-5450
CVE-2026-5928

GHSA-2v4p-qf9q-27wj
GHSA-8wmf-6v46-5gfg

W-24126253

1.14.0

September 2, 2026

MuleSoft announces the release of Omni Gateway 1.14.0.

What’s New

The JavaScript Scripting policy is added to run a user-supplied JavaScript module that can inspect and modify requests and responses directly from the gateway.

See JavaScript Scripting Policy.
The GraphQL Access Control policy is added to authorize incoming GraphQL requests by evaluating Cedar-based access-control rules.

See GraphQL Access Control Policy.
Local storage is now file-based instead of in-memory. State used by policies such as Rate Limiting and HTTP Caching are now retained when Omni Gateway is stopped or restarted.
Configuration caching (control node) is now enabled by default. The FLEX_DATASOURCE_CONTROL_NODE_ENABLED environment variable now defaults to true. To disable it, set the variable to false.

See Configuring Omni Gateway Configuration Caching in Connected Mode.
The OpenID Connect OAuth 2.0 Token Enforcement policy now exposes the Validated Token TTL (maxFederationExpirationTime) and Maximum Cache Entries (maxCacheSize) settings in Connected Mode to control how long validated tokens are cached and how many entries are stored.

See OpenID Connect OAuth 2.0 Token Enforcement Policy.
The JWT Validation policy now supports OAuth 2.0 Protected Resource Metadata (RFC 9728). When enabled, the policy serves a discovery document at the .well-known/oauth-protected-resource endpoint and adds a resource_metadata hint to the WWW-Authenticate header of 401 responses, so clients can locate the authorization server that protects the API.

See JWT Validation Policy.
The Credential Injection OAuth 2.0 policy now supports adding custom parameters, such as audience, to the OAuth 2.0 token request body.

See Credential Injection OAuth 2.0 Policy.
The Message Logging policy now supports data masking to detect and mask personally identifiable information (PII), such as email addresses, in log messages before they are written. You can select built-in PII types (Email, US SSN, Credit Card, and Phone Number) or add custom regex patterns. Data masking is available for both inbound and outbound message logging, and request and response bodies are forwarded to the upstream service unchanged.

See Message Logging Policy and Outbound Message Logging Policy.
The Schema Validation policy now validates multipart/form-data requests against their OAS schema definitions, in addition to application/json request bodies.

See Schema Validation Policy.
You can now configure the DNS refresh rate for upstream service clusters by setting the FLEX_DNS_REFRESH_RATE environment variable. The value is clamped between 5s and 60s, and defaults to 5s.
The flexctl dump CLI command now collects a full snapshot of the gateway’s runtime state into a single ZIP file, including resources, logs, and Envoy statistics. You can write the snapshot to a specific path or stream it to standard output.

See Troubleshooting with the CLI.
The implementation of the DataWeave and SOAP policies is updated to improve policy performance, delivering higher throughput and lower latency.
The flexctl check http command now produces curl-style verbose output, logging request and response headers with > and < prefixes and writing the response body to standard output for easier scripting and inspection.
Flex Gateway deployments managed by Runtime Fabric for Kubernetes now support pod scheduling customizations (node selectors, tolerations, and affinity rules) defined through a KubernetesTemplate custom resource. Customizations take precedence over the corresponding chart-level settings when both are present.
Omni Gateway Docker images are now based on Debian 13 Distroless.

Fixed Issues

Issue Resolution ID

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The WebSocket Connection Limit policy no longer omits rejected connections from the policy violations reported to Anypoint Monitoring.

W-23173354

Flex Gateway no longer rejects valid requests when an API specification (OAS) uses a decimal multipleOf constraint (such as 0.01, 0.001, or 0.1).

W-23192298

Omni Gateway no longer reports as ready when a deployment has failed (for example, when assets could not be downloaded), even when --allow-envoy-errors, --allow-api-errors, or --allow-policy-errors is set to true.

W-23543048

Flex Gateway no longer hangs when its shared storage configuration changes while the gateway is running.

W-23573044

Flex Gateway no longer fails to generate a valid FluentBit log configuration when a label used for log metadata (on the gateway, an API instance, or a service) has an empty value or contains spaces.

W-23147140

Flex Gateway no longer panics when the status and dump endpoints are called before the gateway configuration is fully available during startup.

W-23950422

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-56853

CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-56864
CVE-2026-56865

W-22733262

1.13.6

September 24, 2026

MuleSoft announces the release of Omni Gateway 1.13.6.

Fixed Issues

Issue Resolution ID

Updating gateway.configuration through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.

W-23969934

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Log records larger than 32 KB no longer split into separate lines that lose their logging metadata. Oversized records are truncated instead.

W-24055090

Omni Gateway running in Connected Mode no longer sends duplicate runtime logs to Anypoint Platform after logging configuration changes.

W-24037601

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied twice.

W-24195540

The OpenID Connect OAuth 2.0 Token Enforcement policy now correctly applies defaultTLS.outboundPolicyCalls to identity-provider token requests without applying those settings to Anypoint Platform connections.

W-24268807

The Basic Authentication: LDAP policy no longer includes sensitive authentication data in logs.

W-24118398

These vulnerabilities detected by scanners are now fixed:

CVE-2026-14456
CVE-2026-14457
CVE-2026-18798
CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-5450
CVE-2026-54874
CVE-2026-56853
CVE-2026-56854
CVE-2026-56855
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-5928
CVE-2026-63072
CVE-2026-63073
CVE-2026-63074
CVE-2026-63075
CVE-2026-63076
CVE-2026-75803
CVE-2026-78662
CVE-2026-81870
CVE-2026-81871
CVE-2026-84303
CVE-2026-84304
CVE-2026-84445
GHSA-w67g-5rqw-f597

W-24126253, W-24267883

1.13.5

August 27, 2026

MuleSoft announces the release of Omni Gateway 1.13.5.

Fixed Issues

Issue Resolution ID

Omni Gateway running in Connected Mode no longer disconnects unexpectedly from Anypoint Platform under high-traffic conditions or when the remote server sends data without replying with protocol-level pong frames.

W-23560278

Custom policies no longer crash Omni Gateway with a segmentation fault when a response payload is larger than the buffer limit (1 MB by default). Use the FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES environment variable to increase the buffer limit.

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

Omni Gateway running in Connected Mode no longer sends duplicate deployment-status updates to Anypoint Platform.

W-23862236

The JWT Validation policy no longer bypasses the configured forward proxy when fetching JWKS keys.

W-23840697

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

The Rate Limiting SLA policy with distributed rate limiting enabled no longer crashes the gateway (WASM trap, returning a 503 error instead of 429) under Redis latency and high concurrency on the same SLA tier.

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer return a 503 error on all requests when the exposeHeaders option is enabled and a token claim’s name contains characters that aren’t valid in an HTTP header name.

W-23940967

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

CVE-2022-27943
CVE-2025-27587
CVE-2026-41178
CVE-2026-42767

CVE-2026-56852
CVE-2026-73500
GHSA-259r-337f-4rfw
GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23735964, W-23862957

1.13.4

July 23, 2026

MuleSoft announces the release of Omni Gateway 1.13.4.

Fixed Issues

Issue Resolution ID

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

The SOAP Validation policy no longer leaks temporary directories during configuration delivery. It now loads schema files whose paths contain spaces.

W-23442789

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The JSON Threat Protection policy now accepts valid JSON containing an escaped forward slash (\/), per RFC 8259.

W-23510751

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

1.13.3

July 8, 2026

MuleSoft announces the release of Omni Gateway 1.13.3.

What’s New

Envoy is now upgraded to version 1.37.5.

Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

The readiness probe accuracy is now improved to ensure Omni Gateway only reports as ready when all API configurations are successfully loaded and available for processing traffic. Set --allow-api-errors to false to enable this behavior.

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

SLA tier tracking across authentication policies (Client ID Enforcement, JWT Validation) and Rate Limiting SLA policy is now improved for better analytics and governance.

W-22937088

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

The SOAP Schema Validation policy now correctly processes requests containing nested XOP elements in MTOM payloads

W-21779437

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-45447
CVE-2026-34180
CVE-2026-7383
CVE-2026-45445
CVE-2026-9076
CVE-2026-47774
CVE-2026-47220
CVE-2026-48706

CVE-2026-48042
CVE-2026-48044
CVE-2026-47204
CVE-2026-47221
CVE-2026-48497
CVE-2026-48743
CVE-2026-27145
CVE-2026-42504

W-22698091

1.13.2

June 6, 2026

MuleSoft announces the release of Omni Gateway 1.13.2.

Fixed Issues

Issue Resolution ID

Logging for the flexctl readiness probe is now improved.

W-21615708

The statsEvictionInterval configuration is now added to Envoy bootstrap.

W-22545512

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies now properly populate the authentication.principal property.

W-22696442

The Injection Protection Policy now allows you to apply a policy that uses only custom protections.

W-22491337

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

1.13.1

May 20, 2026

MuleSoft announces the release of Omni Gateway 1.13.1.

Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501
CVE-2026-39817
CVE-2026-39819

CVE-2026-39823
CVE-2026-39825
CVE-2026-39826
GHSA-8rm2-7qqf-34qm
GHSA-wg65-39gg-5wfj
GHSA-fw8g-cg8f-9j28
GHSA-vffh-x6r8-xx99
GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

1.13.0

May 11, 2026

MuleSoft announces the release of Omni Gateway 1.13.0.

What’s New

Flex Gateway is now named to Omni Gateway.

Currently, this is a non-breaking change and only cosmetically affects the UI and documentation. This change shouldn’t affect CI/CD pipelines. There are no changes to these areas:
- Anypoint Platform CLI
- Anypoint Platform APIs
- Logging
- Environment variables
- Documentation URL links
- MCP tool names
Omni Gateway now supports GraphQL APIs.

To add a GraphQL API to Omni Gateway, see Adding an Omni Gateway API Instance.
Omni Gateway now provides these policies to support GraphQL APIs:
- GraphQL Schema Validation: Validates incoming GraphQL operations against a GraphQL schema definition
- GraphQL Introspection Control: Blocks or allows requests that access the schema, type, and __typename GraphQL meta fields
- GraphQL Operation Limits: Limits GraphQL operation depth, aliases, root fields, and directives
- GraphQL Static Query Complexity: Calculates query complexity and blocks requests that exceed the defined budget
Omni Gateway now supports WebSocket APIs.

To add a WebSocket API to Omni Gateway, see Adding an Omni Gateway API Instance.
Omni Gateway now provides the WebSocket Connection Limit to limit the number of simultaneous WebSocket connections that each API instance allows.
Omni Gateway is now supported in CloudHub 2.0 shared spaces.

To deploy a gateway to a shared space, see Deploy a Managed Omni Gateway.
Managed Omni Gateways deployed to CloudHub 2.0 private spaces now provide the Cluster endpoint for traffic internal to the cluster to bypass the CloudHub 2.0 ingress.

See Managed Omni Gateway Endpoints.
MCP Bridge now provides an improved creation experience.

See Adding an MCP Bridge Instance.
Omni Gateway now supports conditional policy application for inbound policies to apply policies to specific methods, URI paths, hosts, and headers. Outbound policies support conditional policy application for specific methods and headers.

See Apply Inbound Omni Gateway Policies.
Envoy is now upgrade to version 1.37.2.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Contracts are no longer dropped when the client secret is null.	W-21177259
The OAuth 2.0 Token Introspection policy now correctly retrieves contracts when `skip_client_id_validation` is `true`.	W-21371313
Readiness signal errors in the OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies are now fixed.	W-21526778
When `FLEX_DATASOURCE_CONTROL_NODE_ENABLED=true`, Connected Mode Omni Gateway can now scale up if Anypoint is unavailable.	W-22300290
CORS policy now supports wildcard (*) origins.	W-19971117

Contracts are no longer dropped when the client secret is null.

W-21177259

The OAuth 2.0 Token Introspection policy now correctly retrieves contracts when skip_client_id_validation is true.

W-21371313

Readiness signal errors in the OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies are now fixed.

W-21526778

When FLEX_DATASOURCE_CONTROL_NODE_ENABLED=true, Connected Mode Omni Gateway can now scale up if Anypoint is unavailable.

W-22300290

CORS policy now supports wildcard (*) origins.

W-19971117

1.12.10

September 25, 2026

MuleSoft announces the release of Omni Gateway 1.12.10.

Fixed Issues

Issue Resolution ID

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Omni Gateway no longer splits log entries longer than 8 KB into continuation lines that can be misclassified. Lines up to 32 KB are preserved, and longer lines are truncated and marked.

W-24055090

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.

W-24195540

These vulnerabilities detected by scanners are now fixed:

CVE-2026-14456
CVE-2026-14457
CVE-2026-18798
CVE-2026-33818
CVE-2026-39821
CVE-2026-46600
CVE-2026-5450
CVE-2026-54874
CVE-2026-56853
CVE-2026-56854
CVE-2026-56855
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862

CVE-2026-5928
CVE-2026-63072
CVE-2026-63073
CVE-2026-63074
CVE-2026-63075
CVE-2026-63076
CVE-2026-75803
CVE-2026-78662
CVE-2026-81870
CVE-2026-81871
CVE-2026-84303
CVE-2026-84304
CVE-2026-84445
GHSA-w67g-5rqw-f597

W-24126253, W-24267883

1.12.9

August 27, 2026

MuleSoft announces the release of Omni Gateway 1.12.9.

What’s New

The OpenTelemetry Collector is now upgraded to version 0.158.0.

Fixed Issues

Issue Resolution ID

Omni Gateway running in Connected Mode no longer disconnects unexpectedly from Anypoint Platform under high-traffic conditions or when the remote server sends data without replying with protocol-level pong frames.

W-23560278

Custom policies no longer crash Omni Gateway with a segmentation fault when a response payload is larger than the buffer limit (1 MB by default). Use the FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES environment variable to increase the buffer limit.

W-23692178

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21764662

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Custom policies no longer cause a memory leak that can increase memory usage over time.

W-23941703

Omni Gateway no longer produces a malformed path predicate (such as a duplicate or missing slash) when a negative-lookahead path pattern is combined with an API base path.

W-23912976

The Credential Injection OAuth 2.0 policy no longer ignores the configured caching duration when the OAuth 2.0 provider’s token response omits the token expiration value.

W-23705875

The Rate Limiting SLA policy with distributed rate limiting enabled no longer crashes the gateway (WASM trap, returning a 503 error instead of 429) under Redis latency and high concurrency on the same SLA tier.

W-23652660

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer forward the raw error response from the introspection server to the client.

W-23665332

The OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies no longer return a 503 error on all requests when the exposeHeaders option is enabled and a token claim’s name contains characters that aren’t valid in an HTTP header name.

W-23940967

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

The OAuth 2.0 Token Introspection policy no longer fails when the introspection URL includes an explicit default port.

W-23471294

These vulnerabilities detected by scanners are now fixed:

CVE-2022-27943
CVE-2025-27587
CVE-2026-41178
CVE-2026-42767

CVE-2026-56852
CVE-2026-73500
GHSA-259r-337f-4rfw
GHSA-hrxh-6v49-42gf

W-23490974, W-23559915, W-23862957

1.12.8

July 21, 2026

MuleSoft announces the release of Omni Gateway 1.12.8.

Fixed Issues

Issue Resolution ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

Omni Gateway now supports deployments in environments using non-standard IP address ranges (240.0.0.0/4).

W-22771253

The handling of rate-limited responses when downloading API configurations is now improved to reduce failures during high-traffic periods.

W-23202349

The readiness probe accuracy is now improved to ensure Omni Gateway only reports as ready when all API configurations are successfully loaded and available for processing traffic. Set --allow-api-errors to false to enable this behavior.

W-23297348

The XML Threat Protection policy now correctly validates and processes XML payloads.

W-18172654

The Injection Protection policy pattern matching is now improved for better threat detection accuracy.

W-22693332

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

Policy initialization during Envoy configuration generation is now faster. Wasm module inspection and compilation are now cached across policies that share the same module.

W-23480384

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

1.12.7

June 6, 2026

MuleSoft announces the release of Anypoint Omni Gateway 1.12.7.

Fixed Issues

Issue Resolution

ID

The principal is no longer always null in the authentication object for OpenID Connect OAuth 2.0 Token Enforcement and OAuth 2.0 Token Introspection policies.

W-22696442

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

1.12.6

May 20, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.6.

Fixed Issues

Issue Resolution ID

The OpenTelemetry Collector now correctly starts in environments (such as Google Cloud Run) that were previously failing.

W-22419420

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21484884

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

The Injection Protection Policy now allows you to apply a policy that only uses custom protections.

W-22491337

Contract resiliency for PDK now improves resource usage.

W-22048194

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501
CVE-2026-39817
CVE-2026-39819

CVE-2026-39823
CVE-2026-39825
CVE-2026-39826
GHSA-8rm2-7qqf-34qm
GHSA-wg65-39gg-5wfj
GHSA-fw8g-cg8f-9j28
GHSA-vffh-x6r8-xx99
GHSA-wg65-39gg-5wfj

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992, W-22477420, W-22477544, W-22509994, W-22509995

1.12.5

May 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.5.

Fixed Issues

Issue Resolution	ID
MCP and A2A metrics are now reported correctly.	W-22346105
The OAuth 2.0 Token Introspection and OpenID Connect OAuth 2.0 Token Enforcement policies now correctly use the consumer URL for protected resource metadata.	W-22215222

Issue Resolution

ID

MCP and A2A metrics are now reported correctly.

W-22346105

The OAuth 2.0 Token Introspection and OpenID Connect OAuth 2.0 Token Enforcement policies now correctly use the consumer URL for protected resource metadata.

W-22215222

1.12.4

April 29, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.4.

What’s New

Envoy is now updated to version 1.35.10.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-22139443

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-22139443

1.12.3

April 22, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.3.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-22028896
The DataWeave `--` operator now correctly removes entries from an object.	W-21643871
The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.	W-22061343
Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.	W-22108203

Vulnerabilities detected by scanners are now fixed.

W-22028896

The DataWeave -- operator now correctly removes entries from an object.

W-21643871

The OpenID Policy now correctly sends identity provider credentials in the header instead of the body.

W-22061343

Rate Limiting policies now correctly distribute the quota between replicas when distributed rate-limiting is enabled.

W-22108203

1.12.2

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.2.

What’s New

The OAuth 2.0 Token Introspection Policy and OpenID Connect OAuth 2.0 Token Enforcement Policy now support the OAuth 2.0 discovery flow and parameters required for MCP clients.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-21668427
When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.	W-21471214

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

When making outbound requests from policies, the port is no longer included in the request authority unless the port is explicitly specified in the target URL.

W-21471214

1.12.1

March 2, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.1.

Fixed Issues

Issue Resolution	ID
Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.	W-21361063

Issue Resolution

ID

Managed Flex Gateway deployed on CloudHub 2.0 no longer produces UDP log errors.

W-21361063

1.12.0

February 25, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.12.0.

What’s New

Managed Flex Gateway now supports Runtime Fabric deployments.

See Deploying Managed Flex Gateway on Runtime Fabric.
Extra Large Managed Flex Gateway is now available for production purposes with higher throughput and more process demanding policies.

To learn more about the performance metrics for Extra Large Managed Flex Gateway, see Managed Flex Gateway Limits and Performance Metrics.
Flex Gateway now supports creating an MCP Bridge to expose API instances as an MCP server.

See Adding an MCP Bridge Instance.
These DataWeave policies are added to modify and filter requests:
- DataWeave Body Transformation Policy: Transforms request or response body content with a DataWeave script
- DataWeave Headers Transformation Policy: Transforms request or response headers with a DataWeave script
- DataWeave Request Filter Policy: Filters requests by using a DataWeave script
A Credential Injection JWT Generation policy is added to generate and inject JWT tokens into outgoing requests.

See Credential Injection JWT Generation Policy.
A Injection Protection policy is added to scan incoming request headers, path, query string, and body for SQL injection, XSS (Cross-Site Scripting), and custom injection attacks.

See Injection Protection Policy.
Functionality is added to configure TLS for outgoing HTTP requests from Self-Managed Flex Gateway policies.

See Configuring TLS for Outgoing Policy Requests.
Managed Flex Gateway and Self-Managed Flex Gateway running in Connected Mode now provides the Runtime Configuration tab in Runtime Manager to configure and edit logging, tracing, timeouts, circuit breakers, probes, and other runtime properties.
SOAP APIs now support Payloads over 1MB.
Managed Flex Gateway replicas now communicate directly with each other for real-time sharing of HTTP caching and rate limiting data instead of using Object Storage V2.

See Managed Omni Gateway High Availability and Disaster Recovery Deployments.
Flex Gateway now supports dw::Core::-- DataWeave functions.

See -- Functions.

Fixed Issues

Issue Resolution	ID
The SOAP Schema Validation Policy no longer intermittently bypasses validation	W-20173820
Flex Gateway no longer has a usage mismatch when using an HTTP probe.	W-20278837
Flex Gateway now retries to download contracts from Anypoint Platform after failure.	W-20435629
Flex Gateway no longer has temporary request failures during API specification (OAS) updates.	W-20646216
JSON Threat Protection Policy no longer rejects numeric exponential notation.	W-21186984
Vulnerabilities detected by scanners are now fixed.	W-21188054
Flex Gateway no longer loses metric data when A2A and MCP policies are applied.	W-21016899

Issue Resolution

ID

The SOAP Schema Validation Policy no longer intermittently bypasses validation

W-20173820

Flex Gateway no longer has a usage mismatch when using an HTTP probe.

W-20278837

Flex Gateway now retries to download contracts from Anypoint Platform after failure.

W-20435629

Flex Gateway no longer has temporary request failures during API specification (OAS) updates.

W-20646216

JSON Threat Protection Policy no longer rejects numeric exponential notation.

W-21186984

Vulnerabilities detected by scanners are now fixed.

W-21188054

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.9.17

September 24, 2026

MuleSoft announces the release of Omni Gateway 1.9.17.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
Updating `gateway.configuration` through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.	W-23969934
Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.	W-22456427
The `FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE` environment variable now limits filesystem buffering for all Fluent Bit outputs.	W-24062935
Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.	W-24195540

Updating gateway.configuration through the Omni Gateway Helm chart no longer causes a full pod rollout or removes the active configuration.

W-23969934

Configuration caching (control node) reliability is improved, including Redis recovery, deployment status, and configuration synchronization.

W-22456427

The FLEX_FLUENTBIT_OUTPUT_STORAGE_TOTAL_LIMIT_SIZE environment variable now limits filesystem buffering for all Fluent Bit outputs.

W-24062935

Managed Omni Gateway deployments on Runtime Fabric no longer fail when the same image pull secret is supplied by both Gateway Manager and Runtime Fabric.

W-24195540

1.9.16

August 27, 2026

MuleSoft announces the release of Omni Gateway 1.9.16.

Fixed Issues

Issue Resolution ID

The Basic Authentication: LDAP policy no longer lets specially crafted usernames to manipulate the underlying LDAP search filter.

W-23573199

Resetting Redis shared storage no longer fails with a cross-slot error in cluster-mode deployments (such as AWS ElastiCache).

W-23687400

Control node no longer discards synchronization state after 14 days to prevent inconsistencies when a gateway reconnects following an extended outage.

W-23692384

The configuration caching (control-node) temporal inconsistency in the watcher and notifier is now fixed.

W-21764662

Configuration caching (control node) now works with AWS ElastiCache Serverless. Redis shared storage now uses the non-blocking SCAN command instead of KEYS. If your Redis access policy allows the KEYS command, update it to allow SCAN.

W-23399906

Control node Redis shared storage no longer grows without bound over time from historical configuration-change data.

W-23748466

Control node no longer fails to apply deployment updates when multiple replicas write to the same resource at nearly the same time.

W-23748463, W-23748465

Control node no longer delays propagating a configuration update or logs a false inconsistency warning after a transient failure while committing that update.

W-23754016

Omni Gateway running in Connected Mode no longer disrupts running pods when its registration credentials are renewed.

W-23820257

The contract collector now honors the Retry-After header and properly waits between polls when downloading API configurations.

W-23460693

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33818
CVE-2026-39821
CVE-2026-41178
CVE-2026-46600
CVE-2026-56852
CVE-2026-56853
CVE-2026-56858

CVE-2026-56859
CVE-2026-56860
CVE-2026-56862
CVE-2026-56864
CVE-2026-56865
CVE-2026-73500
GHSA-hrxh-6v49-42gf

W-23559915, W-23735964, W-23862957

1.9.15

July 21, 2026

MuleSoft announces the release of Omni Gateway 1.9.15.

Fixed Issues

Issue Resolution

ID

Omni Replicas no longer fail to receive configuration updates in Connected Mode when the hostname changed.

W-23123632

HTTP retry logic now drains response bodies between retry attempts to prevent connection pool exhaustion.

W-23252601

These vulnerabilities detected by scanners are now fixed:

CVE-2026-34182
CVE-2026-34180
CVE-2026-45445
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-39822

CVE-2026-42504
CVE-2026-27145
CVE-2026-42766
CVE-2026-45446
CVE-2026-42505
CVE-2026-42507
CVE-2026-42770

W-22698091

1.9.14

June 6, 2026

MuleSoft announces the release of Anypoint Omni Gateway 1.9.14.

Fixed Issues

Issue Resolution

ID

These vulnerabilities detected by scanners are now fixed:

VE-2025-15281
CVE-2026-0861
CVE-2026-0915
CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-32952
CVE-2026-33814
CVE-2026-39821
CVE-2026-39824
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39831

CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-39835
CVE-2026-4046
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-4437
CVE-2026-4438
CVE-2026-46595
CVE-2026-46597
CVE-2026-46598
CVE-2026-4878

W-22698091

1.9.13

May 20, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.13.

Fixed Issues

Issue Resolution ID

The flexctl dump error message is now improved when redis is unavailable.

W-22365034

These vulnerabilities detected by scanners are now fixed:

CVE-2026-33811
CVE-2026-33814
CVE-2026-39820
CVE-2026-39836
CVE-2026-42499
CVE-2026-42501

CVE-2026-39817
CVE-2026-39819
CVE-2026-39823
CVE-2026-39825
CVE-2026-39826

W-22478633, W-22478649, W-22478660, W-22478666, W-22478702, W-22509993, W-22509992

1.9.12

April 24, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.12.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-22028896

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-22028896

1.9.11

March 31, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.11.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-21668427

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-21668427

1.9.10

March 5, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.10.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-21259850
Trace configuration now supports setting up a trusted CA.	W-21018187
The JSON Threat Protection policy no longer rejects numeric exponential notation.	W-21186984
The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.	W-20531156
Flex Gateway no longer loses metric data when A2A and MCP policies are applied.	W-21016899

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-21259850

Trace configuration now supports setting up a trusted CA.

W-21018187

The JSON Threat Protection policy no longer rejects numeric exponential notation.

W-21186984

The Schema Validation policy now validates the raw URL-encoded raw value instead of the URL-decoded value.

W-20531156

Flex Gateway no longer loses metric data when A2A and MCP policies are applied.

W-21016899

1.9.9

January 7, 2026

MuleSoft announces the release of Anypoint Flex Gateway 1.9.9.

Fixed Issues

Issue Resolution	ID
Vulnerabilities detected by scanners are now fixed.	W-20365927
If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.	W-19647107
Flex Gateway now correctly sends logging information to Anypoint Platform.	W-20365743

Issue Resolution

ID

Vulnerabilities detected by scanners are now fixed.

W-20365927

If an error occurs when the JWT Validation policy calls the JWKS server, the time between retry requests now doubles with each request.

W-19647107

Flex Gateway now correctly sends logging information to Anypoint Platform.

W-20365743

1.9.8

November 13, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.8.

Fixed Issues

Issue Resolution	ID
Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.	W-20037629
Vulnerabilities detected by scanners are now fixed.	W-20125828

Issue Resolution

ID

Flex Gateway running in Connected Mode now retries when requests to Anypoint Platform fail.

W-20037629

Vulnerabilities detected by scanners are now fixed.

W-20125828

1.9.7

October 17, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.7.

What’s New

For the Rate Limiting and SLA-Based Rate Limiting policies, if distributed rate limiting is enabled, the policy resizes time windows under 10 seconds linearly. For example, if you configure a max of 10 requests per 5 seconds, the policy resizes that window to a max of 20 requests per 10 seconds.

See Rate Limiting: SLA-Based Policy and Rate Limiting Policy.

Fixed Issues

Issue Resolution	ID
Flex Gateway registration calls from Docker no longer fail for Hyperforce deployments.	W-19444135
Vulnerabilities detected by scanners are now fixed.	W-19787132, W-19971092
The Connected Mode deployment process is now improved.	W-19861373

Issue Resolution

ID

Flex Gateway registration calls from Docker no longer fail for Hyperforce deployments.

W-19444135

Vulnerabilities detected by scanners are now fixed.

W-19787132, W-19971092

The Connected Mode deployment process is now improved.

W-19861373

1.9.6

August 26, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.6.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
OAS Schemas are now correctly present in the local configuration cache.	W-18833198
The Envoy agent now properly restarts child processes that end with a core dump or kill signal.	W-19327530
The readiness probe no longer fails when the OAuth Token Introspection policy has `skip_client_id_validation` enabled.	W-19118057
The readiness probe no longer fails when the OpenID Connect OAuth 2.0 Token Enforcement policy has `skip_client_id_validation` enabled.	W-19304854
Vulnerabilities detected by scanners are now fixed.	W-19095531, W-19308177
Flex Gateway now validates that there are no collisions when an API base path uses regex expressions.	W-19149269

OAS Schemas are now correctly present in the local configuration cache.

W-18833198

The Envoy agent now properly restarts child processes that end with a core dump or kill signal.

W-19327530

The readiness probe no longer fails when the OAuth Token Introspection policy has skip_client_id_validation enabled.

W-19118057

The readiness probe no longer fails when the OpenID Connect OAuth 2.0 Token Enforcement policy has skip_client_id_validation enabled.

W-19304854

Vulnerabilities detected by scanners are now fixed.

W-19095531, W-19308177

Flex Gateway now validates that there are no collisions when an API base path uses regex expressions.

W-19149269

1.9.5

July 2, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.5.

What’s New

Fluent Bit is now updated to version 3.2.10.

Fixed Issues

Issue Resolution ID

Flex Gateway no longer ignores the json_date_format Fluent-Bit option.

W-18465012

Vulnerabilities detected by scanners are now fixed.

W-18820570

The Credential Injection OAuth 2.0 policy no longer fails if the expires_in attribute is a string.

W-18779819

The Schema Validation policy now recognizes encoded query params correctly.

W-18883397

1.9.4

June 4, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.4.

Fixed Issues

Issue Resolution

ID

Deploying Flex Gateway with IPv6 disabled no longer causes an error.

W-18671361

1.9.3

May 28, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.3.

What’s New

Flex Gateway now supports the Model Context Protocol (MCP) and the Agent2Agent (A2A) Protocol, enabling you to secure, manage, and govern agent interactions:

You can Publish Flex Gateway MCP and A2A Server instances.

See Publishing Omni Gateway Agent and Tool instances.
Flex Gateway now includes MCP and A2A policies. Using these new policies, you can:
- Protect agent interactions: Require that agents are invoked with appropriate authentication and authorization.
- Enhance agent requests: Modify incoming prompts with additional context to improve server agent execution.
- Provide centralized oversight: Enable frictionless agent visibility, logging, and insights for debugging and optimization.
- Secure connections: Restrict MCP endpoint access to authorized agents only.
- Simplify governance: Provide centralized visibility and control over all interactions.
Flex Gateway now includes these policies:

A2A Policies:
- A2A Schema Validation: Verify requests conform to the A2A schema.
  See A2A Schema Validation Policy.
- A2A Agent Card: Proxy the agent through Flex Gateway by rewriting the agent card.
  See A2A Agent Card Policy
- A2A PII Detector: Detect sensitive information in messages sent to and from agents.
  See A2A Personally Identifiable Information (PII) Detector Policy.
- A2A Prompt Decorator: Modify prompt behavior by injecting custom prompts into requests.
  See A2A Prompt Decorator Policy.
- Server-Sent Events (SSE) Content Logging: Log content sent by agents for audit and compliance needs.
  See SSE Logging Policy.
MCP Policies:
- MCP Schema Validation: Verify requests conform to the MCP schema.
  See MCP Schema Validation Policy.
- MCP Support: Enable MCP support and enable Server-Sent Events (SSE).
  See MCP Support Policy.
- MCP Attribute-Based Access Control: Allows you to control access to tools, resources, and prompts, based on Cedar expressions.
  See MCP Attribute-Based Access Control Policy.

To learn more, see:

1.9.2

May 12, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.2.

Fixed Issues

Issue Resolution

ID

The Flex Gateway 1.9.1 TLS context configuration deployment regression is now fixed.

W-18483362

1.9.1

May 8, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.1.

Fixed Issues

Issue Resolution ID

The onDelete event no longer causes a panic.

W-18368903

The Flex Gateway 1.9.0 ForwardProxy regression is now fixed.

W-18202000

The expires_in attribute in the OAuth credential injection policy is now correctly spelled.

W-18201673

Redis keys no longer collide if multiple Flex Gateways use the same Redis server.

W-18004157

Redeploying one API instance after updating a TLS Context now updates the context for APIs that share the TLS context.

W-17737710

1.9.0

March 18, 2025

MuleSoft announces the release of Anypoint Flex Gateway 1.9.0.

What’s New

Managed Flex Gateway on CloudHub 2.0

Flex Gateway now includes Managed Flex Gateway, a fully hosted version of Flex Gateway on CloudHub 2.0. Managed Flex Gateway provides high availability, autoscaling, less operational overhead, and regular automatic patches and upgrades.

Note: To use Managed Flex Gateway, ensure the business group you want to deploy your gateway to has Managed Flex Gateway Resources.

See Deploy a Managed Omni Gateway.
Flex Gateway Version Lifecycle

MuleSoft introduces two new release channels, Edge and Long-term Support (LTS). Both release channels are available in all deployment models: Managed Flex Gateway, Self-Managed Flex Gateway Connected Mode, and Self-Managed Flex Gateway Local Mode. Edge releases will be available three times per year, and LTS releases will be available once a year.

See Omni Gateway Version Lifecycle.
Outbound Policy Support

Outbound policies are policies applied to specific upstreams. To find the new outbound policies, see Outbound Policies Directory.

To apply outbound policies with UI, see Applying Policies for Managed Omni Gateways and Connected Mode. To apply a policy to a service in Local Mode, see Secure an API with an Automated Resource-Level Policy.
Flex Local Configuration Cache

Flex Gateway running in Connected mode can now cache its gateway configuration in shared storage for faster replica initiation, reduced startup times, and accelerated autoscaling.

See Configuring Omni Gateway Configuration Caching in Connected Mode.
Flex Scalability

Flex Gateway now supports up to 1,000 APIs per gateway.
API Timeouts

Flex Gateway now provides the Stream Idle timeout, Response timeout, and Upstream Idle timeout. You can apply the timeouts to the gateway or individual APIs and upstreams as policies. To learn more, see:

Fixed Issues

Issue Resolution

ID

When deployed to a Virtual Machine (VM), a Self-Managed Flex Gateway no longer fails to restart after an abrupt stop of the VM.

W-17640917

Known Issues

The Flex Gateway is unable to send logs when a forward proxy is enabled known issue was introduced in Flex Gateway 1.9.0.

For more information, see Salesforce Known Issues and set the category to Mulesoft Flex Gateway.