RATATOSKRATATOSK
Sign in

Istio

1.31.3Networking & Messaging
Oct 22, 2026

ACTION 3OTHER 4

A security-focused maintenance release removes trust in compromised certificate authorities and updates security-sensitive certificate validation dependencies. It also fixes operator-visible defects, while the ambient readiness check remains opt-in.

Action needed (3)

  • securityCompromised eMudhra CA trust removal

    Trust in compromised eMudhra intermediate CA certificates was removed from the CA bundle in the Ubuntu-based and distroless images. The bundle no longer includes emSign ECC Root CA - G3.

  • securityCVE-2026-111943 certificate-chain rejection

    Go was updated to 1.26.10 in istiod, istioctl, and pilot-agent. The update rejects certificate chains containing any of the compromised eMudhra intermediate keys.

  • securityThe rustls-webpki version in ztunnel, updated

    rustls-webpki in ztunnel was updated to 0.103.16. The update rejects certificate chains containing any of the compromised eMudhra intermediate keys.

All 4 other recorded changesfixes 4

fixes (4)

  • - Fixed the ambient node-untaint controller removing the cni.istio.io/not-ready taint when only istio-cni was ready. It can now also wait for ztunnel to be ready on the node, so pods are not scheduled onto a node whose ztunnel is still wedged. This is off by default on this release branch and is enabled with PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true . Only applies when ambient is enabled. ( Issue #52073 )
  • - Fixed istiod failing to start when the self-signed CA certificate in istio-ca-secret has expired, which can happen when the deployment is scaled to zero for longer than the certificate TTL. The expired certificate is now automatically renewed using the existing private key.
  • - Fixed istioctl bug-report --duration not filtering logs when used without --end-time .
  • - Fixed unhealthy endpoint propagation when PILOT_AUTO_SEND_UNHEALTHY_ENDPOINTS or PILOT_SEND_UNHEALTHY_ENDPOINTS is enabled. Unready pods selected by ServiceEntry resources and unhealthy health-checked WorkloadEntry resources selected by Kubernetes Services or ServiceEntry resources are now retained with their health status instead of being omitted. With PILOT_AUTO_SEND_UNHEALTHY_ENDPOINTS enabled (the default), these endpoints can now appear in endpoint discovery responses with unhealthy status.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →