Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×Project: IstioClear ×

Istio1.29.1Networking & MessagingMar 10, 2026

ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
CVE-2026-26308 fixes a multivalue header bypass in RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
Applies if you use JWKS Resolver.
CVE-2026-31837 and GHSA-v75c-crr9-733c fix the JWKS Resolver failure that could allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method restriction
Applies if you use HTTP.
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
+ 7 more on the release page

Source ↗

Istio1.28.5Networking & MessagingMar 10, 2026

ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

securityhighCVE-2026-26308 multivalue header bypass fix in RBAC
CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.
securitymediumCVE-2026-26311 HTTP decode method fix
CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write in Istio.
securitymediumCVE-2026-26330 ratelimit response phase crash fix
CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

securityAuthentication for XDS debug endpoints on port 15010
Applies if you expose XDS debug endpoints.
XDS debug endpoints on plaintext port 15010 now require authentication, preventing unauthenticated access to proxy configuration.
securityBearer token realm URL validation for WasmPlugin image fetching
Applies if you use WasmPlugin image fetching.
WasmPlugin image fetching now validates bearer token realm URLs to fix a potential SSRF.
securityNamespace-based authorization for HTTP debug endpoints on port 15014
Applies if you expose HTTP debug endpoints.
HTTP debug endpoints on port 15014 now enforce namespace-based authorization, preventing cross-namespace proxy data access.

Source ↗

Istio1.27.8Networking & MessagingMar 10, 2026

ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

securitymediumCVE-2026-26311 HTTP decode method correction
CVE-2026-26311 blocks HTTP decode methods after a downstream reset.
securitymediumCVE-2026-26310 scoped IPv6 address crash fix
CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.
securitymediumCVE-2026-26309 JSON off-by-one write fix
CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

securityhighCVE-2026-26308 multivalue header bypass fix
Applies if you use RBAC.
CVE-2026-26308 fixes a multivalue header bypass in RBAC.
securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix
Applies if you use JWKS Resolver.
CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS Resolver failure that could allow authentication bypass using known default keys.
securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix
Applies if you use Debug Endpoints.
CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.
+ 3 more on the release page

Source ↗

Browse by month