Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

May 2026Clear ×Project: IstioClear ×

Istio1.29.3Networking & MessagingMay 18, 2026

ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump
Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

securityRegex handling in AuthorizationPolicy identity fields
Applicability is not stated in the release notes.
AuthorizationPolicy no longer embeds unescaped regex metacharacters from certain identity fields in the generated Envoy SafeRegex. This fixes the resulting authorization bypass.
breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes
Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).
istio-cni fixes kubelet health probe failures for ambient mesh pods on AWS EKS when using Security Groups for Pods (branch ENI). The fix covers the AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE capability.

Source ↗

Istio1.28.7Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.

Action needed (1)

securitySame-namespace authorization for StatusGen XDS debug endpoints
The StatusGen-served XDS debug endpoints istio.io/debug/syncz and istio.io/debug/config_dump now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.

Check if affected (1)

securityEscaped regex metacharacters in AuthorizationPolicy identity fields
Applies if you configure source.principals or source.namespaces.
AuthorizationPolicy now escapes regex metacharacters in identity fields before embedding them in generated Envoy SafeRegex expressions. This prevents characters such as . or [ in legal Kubernetes names from being treated as regex wildcards in source.principals suffix matches and source.namespaces.

Source ↗

Browse by month