RATATOSKRATATOSK
Sign in

Istio

1.31.1Networking & Messaging
Sep 21, 2026

CHECK 5OTHER 22

A maintenance and security release fixes several security flaws and correctness issues. It also improves performance and updates Kiali.

Check if affected (5)

  • securityBackendTLSPolicy plaintext fallback

    Applies if you use BackendTLSPolicy.

    GHSA-qm8v-g4f9-qhjx fixes BackendTLSPolicy failing open to plaintext on sidecar proxies when its CA reference is unresolved.

  • securitySanitized multicluster kubeconfigs in istioctl analyze

    Applies if you use istioctl analyze.

    istioctl analyze no longer builds Kubernetes clients directly from istio-system multicluster secrets without sanitizing the kubeconfig. The kubeconfig is sanitized in the same way as istiod, preventing crafted secrets from running an exec credential plugin or using other unsafe authentication fields on the machine running istioctl.

  • securityistio.io/use-waypoint-canary namespace isolation

    Applies if you use istio.io/use-waypoint-canary and serviceEntryVisibility.

    The istio.io/use-waypoint-canary label no longer bypasses serviceEntryVisibility NAMESPACE isolation. A canary waypoint now receives the same cross-namespace refusal as the primary waypoint.

  • securitySSRF protection for jwksUri fetching

    Applies if you use jwksUri.

    istiod now blocks link-local and known cloud metadata addresses at the dial level when fetching jwksUri values, and rejects responses that are not valid JWKS. Private and loopback ranges remain reachable and can be blocked with BLOCKED_CIDRS_IN_JWKS_URIS.

  • securityEscaped sidecar.istio.io/* annotations

    Applies if you use sidecar.istio.io/* annotations.

    The sidecar.istio.io/* annotations proxyImage, bootstrapOverride, logLevel, componentLogLevel, and agentLogLevel are now escaped at every template sink. This prevents crafted annotation values from injecting fields into generated pod or deployment specifications.

All 22 other recorded changesfixes 20 · value changes 2

fixes (20)

  • - Fixed an issue in ambient mode where the CNI node agent auto-detected iptables backend ( legacy vs nft ) could flip between agent restarts, causing duplicate redirect rules to be written into already-enrolled pods. ( Issue #61020 )
  • - Fixed the ability to clear the Certificate Revocation List (CRL) by either specifying an empty string as the ca-crl.pem or removing it. ( Issue #61073 )
  • - Fixed the JWKS resolver forcing all public-key fetches to HTTP/1.1. The custom TLSClientConfig and DialContext used for TLS pinning and CIDR blocking caused Go’s net/http to disable automatic HTTP/2, so ALPN never negotiated h2. HTTP/2 is now re-enabled (matching http.DefaultTransport ), fixing JWKS fetches that fail over HTTP/1.1 through some HTTP CONNECT proxies. ( Issue #61250 )
  • - Fixed an issue where istiod CPU usage increased as the number of AuthorizationPolicies increased. ( Issue #61254 )
  • - Fixed ALLOW_ANY_DYNAMIC_DNS traffic failing in IPv6-only clusters because Envoy used the IPv4 loopback address to reach the DNS proxy. ( Issue #61330 )
  • - Fixed an issue where istiod repeatedly serialized the same workload when pushing workload metadata to Envoy proxies. ( Issue #61502 )
  • - Fixed an issue where Envoy proxies subscribed to Workload metadata discovery (MDS) did not receive incremental workload updates for Address-only changes when AMBIENT_SCOPED_ADDRESS_PUSHES was enabled (the default).
  • - Fixed an issue where an agentgateway waypoint that a service referenced only as its canary, via the istio.io/use-waypoint-canary label, was not programmed with the routes and policies attached to that service. Connections shifted to the canary waypoint were rejected, because the waypoint had no configuration for the service it was fronting. ( Issue #61036 )
  • - Fixed a memory leak affecting Istiod ambient multi-cluster mode where rotating a remote cluster’s credentials leaked that cluster’s entire cached state. ( Issue #60033 )
  • - Fixed the default chart’s ValidatingWebhookConfiguration still hardcoding failurePolicy: Ignore , which caused the same field manager conflict on helm upgrade with server-side apply that was previously fixed for the base and istiod charts. ( Issue #61613 )
  • - Fixed an issue where istiod permanently retained a copy of every workload resource name for each envoy MDS (WDS, used for telemetry metadata lookups) connection that sent initial_resource_versions .
  • - Fixed the sidecar.istio.io/statsFlushInterval annotation producing an invalid Envoy bootstrap for values of one minute or more, and for sub-second values, which prevented the proxy from starting.
  • - Fixed the sidecar.istio.io/statsEvictionInterval annotation silently truncating sub-second precision.
  • - Fixed a Gateway API issue where a cross-namespace TLS certificateRef or caCertificateRef was resolved before the ReferenceGrant authorization check, so a listener’s ResolvedRefs status could distinguish whether the referenced Secret or ConfigMap existed even when no grant permitted the reference. Authorization now runs first, returning RefNotPermitted for any ungranted cross-namespace reference. Credit : This issue was reported by Darryl Jaskolski.
  • - Fixed a memory leak in ambient multi-cluster mode where collections were registered with the krt debugger but never unregistered when a remote cluster was removed or its configuration changed, causing debugger registrations to accumulate over time. ( Issue #60033 )
  • - Fixed listener conflict tracking treating a Gateway and a ListenerSet with the same namespace and name as the same object, which caused a conflict recorded for one to mark the other’s winning listener as Conflicted and stop it from being programmed.
  • - Fixed ServiceEntries with a present but empty workload selector incorrectly matching all workloads in their namespace.
  • - Fixed a pod in a remote cluster, selected by a ServiceEntry may not have been recomputed when it became an endpoint of that service. The recompute was addressed to the cluster istiod runs in rather than the cluster the pod belongs to.
  • - Fixed a WorkloadEntry selected by a Service not having its corresponding proxy recomputed when it became an endpoint of that service.
  • - Fixed observedGeneration getting stuck on a stale value when a resource is modified again while an earlier status write is still queued.

value changes (2)

  • - Improved performance when fetching PeerAuthentications for a given workload.
  • - Updated Kiali addon to version v2.31.0.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →