RATATOSKRATATOSK
Sign in

Istio

1.28.4Networking & Messaging
Feb 16, 2026

CHECK 5OTHER 7

Istio 1.28.4 contains security fixes for cgo comment parsing, TLS session resumption, gateway resource creation, debug endpoint access, and pod template rendering. It also changes authorization behavior for debug endpoints and tightens validation in controllers and annotations.

Check if affected (5)

  • securitycriticalCVE-2025-68121 TLS session resumption flaw

    Applies when using crypto/tls session resumption with mutable ClientCAs or RootCAs.

    CVE-2025-68121 is addressed in crypto/tls session resumption. Resumed handshakes now fail when ClientCAs or RootCAs change between the initial and resumed handshake, including configurations using Config.Clone or Config.GetConfigForClient.

  • securityhighCVE-2025-61732 cgo comment parsing flaw

    Applies when cgo binaries are built from code containing Go and C/C++ comments.

    CVE-2025-61732 is addressed in the Go and C/C++ comment parsing used to produce cgo binaries. The fix prevents code smuggling caused by differences in comment parsing.

  • securityGateway deployment controller resource validation

    Applies when the gateway deployment controller renders templates that create Kubernetes resources.

    The gateway deployment controller now validates object types, names, and namespaces before creating resources. This prevents template injection from creating arbitrary Kubernetes resources.

  • securityResource annotation validation

    Applies when resource annotations are processed through template rendering.

    Resource annotation validation now rejects newlines and control characters. This blocks template rendering from injecting containers into pod specs.

  • breakingNamespace-based debug endpoint authorization

    Applies when using debug endpoints on port 15014 from non-system namespaces.

    Debug endpoints on port 15014 now use namespace-based authorization. Non-system namespaces are limited to config_dump, ndsz, and edsz, and to proxies in the same namespace. Compatibility mode is available with ENABLE_DEBUG_ENDPOINT_AUTH=false.

All 7 other recorded changesfixes 5 · additions 2

fixes (5)

  • - Fixed a bug where BackendTLSPolicy status could lose track of the Gateway ancestorRef due to internal index corruption. ( Issue #58731 )
  • - Fixed an issue where the istio-cni DaemonSet treated NodeAffinity changes as upgrades, causing CNI config to be incorrectly left in place when a node no longer matched the DaemonSet ’s NodeAffinity rules. ( Issue #58768 )
  • - Fixed incorrect mapping of meshConfig.tlsDefaults.minProtocolVersion to tls_minimum_protocol_version in downstream TLS context.
  • - Fixed an issue causing the ambient multicluster cluster registry to become unstable periodically, leading to incorrect configuration being pushed to proxies.
  • Fixed translation function lookup errors for MeshConfig and MeshNetworks in istioctl.

additions (2)

  • - Added an opt-in feature when using istio-cni in ambient mode to create an Istio owned CNI config file which contains the contents of the primary CNI config file and the Istio CNI plugin. This opt-in feature is a solution to the issue of traffic bypassing the mesh on node restart when the istio-cni DaemonSet is not ready, the Istio CNI plugin is not installed, or the plugin is not invoked to configure traffic redirection from pods to their node ztunnels. This feature is enabled by setting cni.istioOwnedCNIConfig to true in the istio-cni Helm chart values. If no value is set for cni.istioOwnedCNIConfigFilename , the Istio owned CNI config file will be named 02-istio-cni.conflist . The istioOwnedCNIConfigFilename must have a higher lexicographical priority than the primary CNI configuration filename. Ambient and chained CNI plugins must be enabled for this feature to work.
  • - Added a retry mechanism when checking if a pod is ambient enabled in istio-cni . This is to address potential transient failures resulting in potential mesh bypassing. This feature is disabled by default and can be enabled by setting ambient.enableAmbientDetectionRetry in the istio-cni chart.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Istio releases →