Istio

Check if affected (4)

• ▸▾securityIstio 1.29 end of life

  Applies if Istio 1.29 runs.

  Istio 1.29 reached end of life on October 15, 2026. This release includes the end-of-life status under ISTIO-SECURITY-2026-008.

• ▸▾securityTrust in compromised eMudhra intermediate CA certificates, removed

  Applies if you use ubuntu-based images or distroless images.

  Trust in the compromised eMudhra intermediate CA certificates was removed. The CA bundle in ubuntu-based and distroless images no longer includes emSign ECC Root CA - G3, as covered by ISTIO-SECURITY-2026-008.

• ▸▾securityThe rustls-webpki version in ztunnel, updated

  Applies if ztunnel runs.

  rustls-webpki in ztunnel was updated to 0.103.16. It rejects certificate chains containing any of the compromised eMudhra intermediate keys, as covered by ISTIO-SECURITY-2026-008.

• ▸▾securityThe Go fix for CVE-2026-111943, absent from Istio 1.29

  Applies if Istio 1.29 runs.

  Istio 1.29 does not include the Go fix for CVE-2026-111943 because it is built with Go 1.25, which no longer receives fixes. istiod, istioctl, and pilot-agent rely on the updated CA bundle only; Istio 1.30.7 or 1.31.3 includes the Go fix.