Security

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical security updates and enhance Istiod stability. 📝 Summary Istio 1.30.7 delivers essential security enhancements and crucial bug fixes for improved reliability. A critical update addresses the emSign ECC Root CA - G3 distrust by refreshing distroless base images, bolstering the trust chain for Istio components. This release also resolves a significant Istiod startup issue where expired self-signed CA certificates now automatically renew, preventing service interruptions after prolonged scale-to-zero periods. For authorization, :method header matching in policies is now case-insensitive, aligning with expected behavior. Ambient mesh users can opt-in to a new feature (PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true) that ensures ztunnel readiness before scheduling pods to untainted nodes, preventing workloads from landing on unready proxies. Furthermore, istioctl bug-report --duration now filters logs correctly, even without an --end-time specified, streamlining diagnostics. Multiple dependency updates round out this release, reinforcing the mesh’s security posture and overall operational stability. Upgrade promptly to benefit from these vital improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended due to multiple critical and high-severity security fixes. Review the new PILOT_ENABLE_STRICT_GATEWAY_MERGING flag to understand its implications for your Gateway API deployments. 📝 Summary Istio 1.30.6 delivers essential security updates and significant stability improvements. This release addresses multiple critical vulnerabilities, including shell injection in istioctl manifest translate and potential MITM attacks on istioctl XDS connections. It also resolves Denial-of-Service issues related to ambient waypoint address collisions and malformed OIDC/JWT sub claims, along with a WASM image fetcher vulnerability. Beyond security, you’ll find enhanced Gateway API reliability, particularly for InferencePool backendRefs and ListenerSets. Kubernetes API requests now benefit from client-side timeouts, preventing indefinite hangs and boosting control plane resilience. OpenShift users will see more accurate proxy UID/GID assignments. Upgrade swiftly to secure your mesh and leverage these robustness gains. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required, especially for users of BackendTLSPolicy and istioctl analyze. Review other fixes to ensure stability and better support for your mesh. 📝 Summary Istio 1.30.5 brings vital security enhancements and critical stability improvements. Two significant security fixes address a BackendTLSPolicy vulnerability (GHSA-qm8v-g4f9-qhjx) that could lead to plaintext traffic, now safely failing closed. Additionally, istioctl analyze now sanitizes multi-cluster kubeconfig secrets, preventing arbitrary command execution.For Ambient Mesh users, this release delivers more predictable behavior with deterministic network gateway selection, eliminating unnecessary Workload Discovery Service (WDS) pushes. The CNI component benefits from a stable iptables backend detection, resolving flip-flopping issues across restarts. Workload Discovery Service (WDS) performance also sees a boost with pre-marshaled data and improved incremental update handling.Key fixes include ServiceEntries with empty selectors no longer matching all workloads, ensuring precise traffic control. JWKS resolution is more robust with default HTTP/2, and Envoy stats intervals now properly support sub-second and minute-plus configurations. The Gateway API’s ListenerSet status reporting is more accurate, providing clearer insights into resource health. Upgrade promptly to benefit from these crucial updates. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action is required. However, reviewing these updates is recommended to benefit from improved stability, enhanced security, and to better support your users by understanding the strengthened supply chain integrity. 📝 Summary cert-manager v1.20.4 delivers crucial updates focused on strengthening security, improving controller stability, and hardening the release process. This patch release includes a critical fix for the certificate shim, preventing unintended mutation of cached Kubernetes objects—a vital step for controller reliability. You’ll also find a suite of dependency upgrades addressing various underlying security advisories, fortifying cert-manager’s overall supply chain posture. Significant enhancements to the release pipeline now incorporate Cosign signing for metadata, boosting integrity and trust. Furthermore, e2e tests are now more robust with retry mechanisms for Kyverno policy application and dynamic resolution of initial upgrade versions, ensuring a smoother development experience. Review these changes to leverage a more secure and stable cert-manager environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade recommended to patch critical security vulnerabilities and ensure robust ambient mesh operation. 📝 Summary This release, Istio 1.29.7, delivers essential security fixes and significant stability enhancements across the mesh. We’ve tackled multiple vulnerabilities, including an EnvoyFilter regex denial-of-service vector and an SSRF vulnerability in JWKS URI fetching. Critical functional security fixes ensure BackendTLSPolicy now fails closed when CA references are unresolved and close a Gateway API TLS certificateRef existence oracle. For Ambient Mesh users, stability and performance are greatly improved. We’ve resolved issues where ingress gateways bypassed waypoints in multi-cluster setups and prevented hostNetwork pods from erroneous enrollment. Resource management gets a boost with fixes for istio-cni file descriptor leaks and optimized policy scanning. Furthermore, WDS reconnects are now version-aware, significantly reducing traffic during ztunnel reconnections. Core platform reliability also sees important updates, like a fix for istiod leader election goroutine leaks and improved Gateway API port name disambiguation. Upgrade today to fortify your mesh against potential exploits and benefit from a more resilient and efficient Istio experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address multiple security vulnerabilities and benefit from critical bug fixes, especially for ambient mesh users. Review the details for specific impacts on your deployment. 📝 Summary Istio 1.30.4 is here, bringing crucial security patches, significant ambient mesh hardening, and key performance improvements. This release addresses multiple security vulnerabilities, including a critical fix for sidecar annotation injection, preventing potential spec manipulation. It also tightens EnvoyFilter proxyVersion validation against DoS attacks and strengthens JWKS URI fetching to prevent SSRF. Ambient mesh users will find enhanced stability with fixes for CNI kubeconfig deadlocks, improved network namespace ownership validation, and critical goroutine/memory leak remediations in multi-cluster environments. Gateway API operations are smoother: listener conflict resolution is more robust, and TLS ReferenceGrant authorization is corrected. Performance gets a boost with optimized AuthorizationPolicy/PeerAuthentication scanning and more efficient Workload Discovery Service updates. Upgrade now to secure your mesh and leverage these vital enhancements. ...

📋 Recommended Actions ⚠️ Action Required Immediate action is required for existing auto-registered WorkloadEntries to ensure HBONE capability. Review updates to better support your users. 📝 Summary Istio 1.30.3 delivers crucial stability and performance boosts, especially for ambient mesh environments. This release resolves a deadlock in the CNI node agent, fixing a critical issue that could block the ZDS server. A significant performance enhancement comes from suppressing unnecessary XDS pushes for metadata-only VirtualService changes, reducing control plane load. For ambient users, HBONE auto-registration is now more reliable, ensuring non-Kubernetes workloads correctly advertise HBONE, though existing WorkloadEntries may need a manual label update. Operations engineers will appreciate the fix for file-mounted certificate reloads, resolving issues with Kubernetes secret rotations. Additionally, the node untaint controller is now configurable, offering greater flexibility. Upgrade to benefit from these vital bug fixes and improved mesh reliability. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is required to address critical security vulnerabilities. Operations engineers should review the RBAC changes, especially if directly manipulating ACME Challenge or Order resources, as this is a breaking change. 📝 Summary Cert-manager v1.19.6 lands with crucial security updates and hardened RBAC policies, fortifying your certificate management infrastructure. This release addresses three notable Go module vulnerabilities, including CVE-2023-3978 in golang.org/x/crypto and CVE-2023-39325 in github.com/moby/spdystream. These fixes bolster protection against denial-of-service attacks and improve overall system resilience. Additionally, a significant change restricts direct user interaction with ACME Challenge and Order resources. These Kubernetes objects, never intended for manual management, now have tighter controls on creation and modification verbs within the aggregate edit ClusterRole. This helps prevent misconfigurations and reinforces the intended operational model. Upgrading also bumps the Go runtime to v1.25.11 and updates base images, ensuring a more stable and secure environment. Review the RBAC changes to ensure no disruption if your workflows involve direct manipulation of ACME challenge/order resources, otherwise, upgrade promptly for a safer cert-manager deployment. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates, especially for Ambient Mesh and Gateway API users, to better support your users and leverage new security features. 📝 Summary Istio 1.30.2 arrives with a bundle of important bug fixes and a powerful new security feature, significantly enhancing the mesh’s robustness and operational control. This release introduces AuthorizationPolicy trust domains, allowing granular security policies based on the peer certificate’s trust domain. This is a crucial addition for fine-grained access control, enabling users to match or exclude requests from specific trust boundaries.A significant stability improvement comes for Ambient Mesh users with a fix addressing pods that could lose host health-probe IPSet entries after node or kubelet restarts. This change prevents broken probes and ensures more reliable health checks. Gateway API users will benefit from a fix resolving brief traffic outages experienced during canary upgrades when changing istio.io/rev labels on Gateways, ensuring smoother, disruption-free transitions.For better resource management, a memory leak in the KRT controller framework has been patched, leading to more stable memory usage and preventing unnecessary recomputations. Telemetry also sees an update: pilot-agent now correctly handles Prometheus content types by excluding protobuf and offers a new environment variable to disable merging Envoy stats if desired. Improved warning messages for outdated Gateway API CRDs provide clearer guidance. These updates collectively strengthen Istio’s security, stability, and overall operational experience. ...

📋 Recommended Actions ⚠️ Action Required Upgrade to Istio 1.30.1 as soon as possible to benefit from critical stability fixes and improved Gateway API diagnostics. Review the sections on ambient mode, multicluster, and Gateway API headers for specific impacts. 📝 Summary Istio 1.30.1 delivers crucial stability enhancements and significant Gateway API improvements. This release addresses critical issues like a concurrent map writes panic in the CNI agent and a deadlock in the multicluster ClusterStore, bolstering overall mesh reliability. Traffic management sees a vital fix for consistentHash load balancing, ensuring new endpoints receive traffic reliably, resolving an Envoy regression. Ambient mode users will find better traffic distribution with a fix for mutating shared load balancer presets, preventing misconfigurations where traffic was routed to not-ready endpoints. The Gateway API ecosystem gains an important istioctl analyze check (IST0176) that warns about outdated CRD versions, preventing silent failures. External SDS provider logic is refined for more flexible credential management, and invalid HTTP/GRPCRoute header values are now properly reported, enhancing configuration validation. Kiali also receives an update to version 2.26.0. Upgrade promptly to secure these stability and diagnostic benefits. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address critical security vulnerabilities related to authorization bypasses. Operations engineers should review the updated Ambient Mesh configurations for AWS deployments and consider tuning HBONE window sizes for performance. Review istioctl analyze output for new JWKS URI security warnings. 📝 Summary Istio 1.29.3 lands with crucial security fixes, fortifying your mesh against potential bypasses. This release tackles an authorization policy regex vulnerability, ensuring principal and namespace matching behaves as intended. It also tightens XDS debug endpoint access, preventing cross-namespace information exposure for non-system callers. Plus, leaf certificates now respect CA validity, preventing expired cert usage. AWS EKS users with Security Groups for Pods get a critical fix for kubelet health probe failures in Ambient Mesh, ensuring smoother operations. We’ve also added configurable HTTP/2 window sizes for HBONE, offering fine-tuned performance. Tooling improves with a new istioctl analyze warning for JWKS URI security, better handling of Helm webhook failurePolicy during upgrades, and enhanced proxy resource injection for null values. Several core bug fixes, including a multicluster secret controller deadlock and robust Kubernetes secret rotation, contribute to overall stability. ...

📋 Recommended Actions ⚠️ Action Required Immediate action is required for users deploying Istio with Helm v4 (server-side apply) or those with newer Gateway API CRDs. Review the section on Helm failurePolicy to configure base.validationFailurePolicy: Fail as needed. Also, be aware of the new Gateway API CRD maximum version filter, which may ignore newer TLSRoute versions (v1.5.0+). All users should upgrade to benefit from critical security hardening and stability fixes. ...

📋 Recommended Actions ⚠️ Action Required Immediate review and upgrade are recommended to benefit from critical security hardening, traffic management improvements, and enhanced multi-cluster reliability. If using Helm with server-side apply, explicitly configure ‘base.validationFailurePolicy: Fail’ during initial installations or when templating for SSA to avoid potential webhook conflicts. During upgrades, the webhook’s ‘failurePolicy’ will be omitted from the template, preserving the runtime value. 📝 Summary Istio 1.29.2 fortifies your service mesh with significant stability, security, and multi-cluster resilience enhancements. This patch release addresses several critical bugs, including a fix for AuthorizationPolicy regex metacharacter handling and a robust improvement to JWKS URI CIDR blocking, preventing potential bypasses. Operations engineers will appreciate the improved Helm upgrade experience with server-side apply, which resolves a webhook ‘failurePolicy’ conflict and ensures smoother installations. A new CRD filter safeguards against issues with unsupported Gateway API versions, enhancing upgrade predictability. Traffic management sees key improvements: waypoints now support multiple VirtualServices for a single host, and DestinationRule ‘retryBudget’ configurations are more consistently applied. Multi-cluster deployments gain a crucial fallback mechanism for mesh configuration, ensuring continued operation even if remote mesh config is temporarily unreadable. Upgrade promptly to secure your mesh and leverage these vital operational improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade to Istio 1.28.5 is strongly recommended for all users due to critical security patches addressing JWT forgery, XDS debug endpoint authentication bypasses, and WasmPlugin SSRF vulnerabilities. Review changes to XDS debug endpoints if you rely on unauthenticated plaintext access, as this behavior now requires explicit configuration or authentication. 📝 Summary Istio 1.28.5 lands with crucial security updates and significant enhancements across the mesh. This release patches a critical vulnerability where Istio’s JWT authentication fallback mechanism could leak a private key, enabling attackers to forge tokens. A high-severity fix now secures XDS debug endpoints (like syncz and config_dump), preventing unauthenticated access on plaintext ports. Additionally, WasmPlugin image fetching is fortified with SSRF protection, closing another potential attack vector. Beyond security, the Gateway API sees improvements, specifically addressing issues where InferencePool configurations were lost during VirtualService merges. Ambient Mesh deployments get smarter port discovery for native sidecars, ensuring correct inbound listener configuration, and gain new flexibility with a ZtunnelNamespace flag. These updates combine critical fixes with valuable operational improvements, making 1.28.5 a vital upgrade for a more secure and robust service mesh. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is strongly recommended to address critical security vulnerabilities, especially the JWKS private key leak and XDS debug endpoint authentication bypass. Review all updates to ensure smooth operation and leverage new features. 📝 Summary Istio 1.29.1 delivers crucial security fixes, fortifying your mesh against potential exploits. This release patches a critical JWKS private key leak, preventing attackers from forging JWT tokens, and tightens authentication on XDS debug endpoints. Gateway API users will appreciate enhanced CORS wildcard handling and robust backend policy dependency tracking. For ambient mode, a panic with cross-network WorkloadEntries has been resolved, along with a fix for TLS inspection on exclusively TLS ports, improving routing reliability. Deployments now correctly handle null or zero resource limits, eliminating validation errors. Additional improvements include IP allocator stability, SSRF protection in WasmPlugin image fetching, and various nil-pointer dereference fixes, ensuring a more resilient and secure Istio experience. Upgrade promptly to secure your environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address the OpenTelemetry security vulnerability (GO-2026-4394) and to benefit from the latest Go runtime and base image security updates. 📝 Summary Cert-manager v1.19.4 brings crucial security and maintenance updates, bolstering the reliability of your certificate management. This release addresses a medium-severity OpenTelemetry vulnerability (GO-2026-4394) related to sensitive data exposure in HTTP headers, making an upgrade vital for enhanced security posture. We’ve also updated the Go runtime to version 1.25.7, incorporating the latest performance improvements and bug fixes. Furthermore, all base images have been refreshed to Debian 12, ensuring cert-manager components run on the most current and secure foundations. These updates are essential for maintaining a stable and secure Kubernetes environment. Upgrade soon to protect your clusters and leverage these core improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade to Istio 1.28.4 is strongly recommended to address critical security vulnerabilities and enhance mesh stability. Operations engineers should review the new debug endpoint authorization policy (enabled by default) and consider its impact on existing monitoring or tooling that accesses Istiod debug endpoints from non-system namespaces. Enabling ambient.enableAmbientDetectionRetry in the CNI chart is also recommended for increased ambient mesh robustness against transient failures. ...

📋 Recommended Actions ⚠️ Action Required Immediate action required for environments utilizing debug endpoints from non-system namespaces, or if you’re using sidecar.istio.io/proxy* annotations. Review upgrade notes carefully for the debug endpoint authorization feature. For all users, upgrading is strongly recommended to apply critical security fixes and enhancements. 📝 Summary Istio 1.27.6 rolls out critical security enhancements, significantly bolstering the control plane’s resilience against potential vulnerabilities. This patch release introduces robust safeguards to the gateway deployment controller, preventing unauthorized resource creation via template injection. Furthermore, a critical fix addresses a template injection vector in sidecar.istio.io/proxy* annotations, rejecting malicious control characters. Security around debug endpoints is tightened, with namespace-based authorization now enabled by default, restricting access from non-system namespaces. This change requires review if your tooling interacts with these endpoints. Lastly, a bug fix ensures correct application of minimum TLS protocol versions. These updates collectively enhance Istio’s security posture and gateway management, making this a vital upgrade for all deployments. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is strongly recommended to address multiple high-severity security vulnerabilities. Review updates to the vendored ACME client, particularly the deprecation of TLS-SNI-01 and TLS-SNI-02 challenge types, which may impact custom ACME integrations. 📝 Summary cert-manager v1.18.4 lands with vital security fixes and significant ACME protocol updates. This release addresses multiple high-severity CVEs in the underlying Go toolchain and various golang.org/x dependencies, demanding your prompt attention to safeguard your Kubernetes clusters. Beyond security, we’ve refined ACME challenge handling, notably deprecating the insecure TLS-SNI-01 and TLS-SNI-02 challenge types. On the bright side, TLS-ALPN-01 now gracefully supports IP address identifiers, expanding its utility for diverse network configurations. Core components also see a Go version bump and updated distroless base images, boosting overall stability. Upgrade now to secure your certificate management and benefit from improved ACME capabilities. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is highly recommended for all users to benefit from critical stability fixes, especially concerning multi-revision deployments and Gateway API status reporting. Review new InferencePool capabilities to enhance AI/ML workloads. 📝 Summary Istio 1.28.1 delivers essential stability fixes and powerful Gateway API enhancements. This patch release addresses critical issues in multi-revision environments, preventing status conflicts for Gateway API resources like HTTPRoutes. It also resolves a persistent SDS (Secret Discovery Service) WARMING state bug, crucial for secure certificate management. Ambient Mesh users will find significant improvements in service overlap resolution, ensuring Kubernetes Services take precedence over ServiceEntries, and more accurate endpoint discovery within scoped networks. A long-standing bug preventing HTTP servers from routing on the same port as an HTTPS server (but with different binds) has been fixed, enhancing gateway flexibility. Furthermore, the Gateway API Inference Extension now supports multiple targetPorts, a key feature for modern AI/ML workloads. Multiple dependency bumps and cleanup items are also included. Upgrading is a straightforward step to ensure a more robust and predictable Istio deployment. ...