RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Mar 2026Clear ×Project: IstioClear ×
Istio1.29.1Networking & MessagingMar 10, 2026
ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

  • securityhighCVE-2026-26308 multivalue header bypass fix

    Applies if you use RBAC.

    CVE-2026-26308 fixes a multivalue header bypass in RBAC.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix

    Applies if you use JWKS Resolver.

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix the JWKS Resolver failure that could allow authentication bypass using known default keys.

  • securitymediumCVE-2026-26311 HTTP decode method restriction

    Applies if you use HTTP.

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset.

  • + 7 more on the release page
Source ↗
Istio1.28.5Networking & MessagingMar 10, 2026
ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

  • securityhighCVE-2026-26308 multivalue header bypass fix in RBAC

    CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.

  • securitymediumCVE-2026-26311 HTTP decode method fix

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write in Istio.

  • securitymediumCVE-2026-26330 ratelimit response phase crash fix

    CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.

  • securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix

    CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

  • securityAuthentication for XDS debug endpoints on port 15010

    Applies if you expose XDS debug endpoints.

    XDS debug endpoints on plaintext port 15010 now require authentication, preventing unauthenticated access to proxy configuration.

  • securityBearer token realm URL validation for WasmPlugin image fetching

    Applies if you use WasmPlugin image fetching.

    WasmPlugin image fetching now validates bearer token realm URLs to fix a potential SSRF.

  • securityNamespace-based authorization for HTTP debug endpoints on port 15014

    Applies if you expose HTTP debug endpoints.

    HTTP debug endpoints on port 15014 now enforce namespace-based authorization, preventing cross-namespace proxy data access.

Source ↗
Istio1.27.8Networking & MessagingMar 10, 2026
ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

  • securitymediumCVE-2026-26311 HTTP decode method correction

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

  • securityhighCVE-2026-26308 multivalue header bypass fix

    Applies if you use RBAC.

    CVE-2026-26308 fixes a multivalue header bypass in RBAC.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS Resolver authentication fix

    Applies if you use JWKS Resolver.

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS Resolver failure that could allow authentication bypass using known default keys.

  • securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint access fix

    Applies if you use Debug Endpoints.

    CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

  • + 3 more on the release page
Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023