Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Feb 2026Clear ×Project: IstioClear ×

Istio1.28.4Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

securityhighCVE-2025-61732 cgo comment parsing flaw
This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

securitycriticalCVE-2025-68121 TLS session resumption validation
Applies if you use Config.Clone with mutations or Config.GetConfigForClient.
This release fixes crypto/tls session resumption when ClientCAs or RootCAs change between the initial and resumed handshake. The fix covers configurations using Config.Clone with mutations or Config.GetConfigForClient.
securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
This release adds safeguards to the gateway deployment controller that validate object types, names, and namespaces before creating Kubernetes resources. The validation prevents arbitrary resource creation through template injection.
securityResource annotation validation against container injection
Applies if you configure resource annotations.
This release updates resource annotation validation to reject newlines and control characters. The change prevents template rendering from injecting containers into pod specifications.
+ 1 more on the release page

Source ↗

Istio1.27.7Networking & MessagingFeb 16, 2026

ACTION 2View full analysis

A security release addressing two vulnerabilities in cgo comment parsing and crypto/tls session resumption. The fixes are relevant to deployments using the affected Go functionality.

Action needed (2)

securitycriticalCVE-2025-68121 session resumption vulnerability correction
CVE-2025-68121 corrects a crypto/tls session resumption flaw that could let resumed handshakes succeed after ClientCAs or RootCAs changed between the initial and resumed handshake.
securityhighCVE-2025-61732 code-smuggling vulnerability correction
CVE-2025-61732 addresses a discrepancy in Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Source ↗

Istio1.29.0Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
iptables reconciliation is enabled by default. It updates network rules automatically when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
Debug endpoint authorization is enabled by default for debug endpoints on port 15014. It provides namespace-based access controls.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
HTTP compression for Envoy metrics is enabled by default at the Prometheus stats endpoint. Compression uses brotli, gzip, or zstd based on client Accept-Header values.
+ 1 more on the release page

Source ↗

Istio1.27.6Networking & MessagingFeb 10, 2026

ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

securityResource annotation validation
Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

securityGateway deployment controller resource validation
Applies if the gateway deployment controller runs.
The gateway deployment controller now validates object types, names, and namespaces before creating Kubernetes resources through template rendering. This prevents arbitrary resource creation through template injection.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port 15014.
Namespace-based authorization now restricts non-system access on port 15014 to the config_dump, ndsz, and edsz endpoints and to same-namespace proxies. Compatibility behavior can be disabled with ENABLE_DEBUG_ENDPOINT_AUTH=false.

Source ↗

Browse by month