# Istio 1.29.9

> Networking & Messaging · 2026-10-15

A security-focused maintenance release with vulnerability fixes, certificate and transport hardening, and correctness and reliability fixes. It also adds tighter certificate lifetime and registry retry controls, along with client-side request timeouts that may affect existing deployments.

## Action needed
- **[security]** Security fixes
  - This release contains security fixes.
- **[security]** `MAX_RA_WORKLOAD_CERT_TTL` workload certificate limit
  - The new `MAX_RA_WORKLOAD_CERT_TTL` environment variable caps the TTL at 48 hours by default, limiting the blast radius of a stolen istio-token.
- **[breaking]** Client-side request timeouts
  - Requests now time out on the client side, so a stuck request is canceled and the component recovers on its own.

## Check if affected
- **[security]** `GHSA-8vc2-jrm4-835w` in the `OAuth2` HTTP filter
  - Applies if you use the `OAuth2 HTTP filter`.
  - The unauthenticated remote crash in the `OAuth2` HTTP filter on a `CONNECT` request without a `:path` header is fixed. Advisory: `GHSA-8vc2-jrm4-835w`.
- **[security]** `GHSA-47vj-9r25-wv5j` in the `api_key_auth` HTTP filter
  - Applies if you use the `api_key_auth HTTP filter`.
  - The crash in the `api_key_auth` HTTP filter on a `CONNECT` request without a `:path` header is fixed. Advisory: `GHSA-47vj-9r25-wv5j`.
- **[security]** `GHSA-w44g-8m76-8gc5` method matching
  - Applies if you use `AuthorizationPolicy` and `HTTP/2`.
  - `AuthorizationPolicy` method rules can no longer be bypassed over `HTTP/2` by changing the case of the method. Advisory: `GHSA-w44g-8m76-8gc5`.
- **[security]** `GHSA-7p2q-4xvg-vxc6` ambient-mode crash
  - Applicability is not stated in the release notes.
  - The `istiod` crash in ambient mode is fixed when a `ServiceEntry` or another service claims the address of an IP-addressed waypoint. Advisory: `GHSA-7p2q-4xvg-vxc6`.
- **[security]** `istioctl` `istiod` certificate verification
  - Applies if you use `istioctl` with `XDS` and a `service account token`.
  - `istioctl` now verifies the `istiod` certificate when connecting to `XDS` with a service account token.
- **[security]** Shell command injection in `istioctl manifest translate`
  - Applies if you use `istioctl manifest translate`.
  - Crafted values can no longer inject additional shell commands when scripts generated by `istioctl manifest translate` are run.
- **[security]** `CreateCertificate` error responses
  - Applies if you use `CreateCertificate`.
  - `CreateCertificate` no longer returns raw Kubernetes API error text to callers.
- **[security]** Plaintext registry retries via `WASM_INSECURE_REGISTRIES`
  - Applies if you configure `WASM_INSECURE_REGISTRIES`.
  - Plaintext retry is now attempted only for registries that the operator explicitly allowlists through `WASM_INSECURE_REGISTRIES`.
- **[security]** Exact `proxyID` matching for debug APIs
  - Applies if you use `/debug/config_dump`, `/debug/edsz`, or `XDS istio.io/debug/config_dump`.
  - `proxyID` must now be the exact `<pod>.<namespace>` or full connection ID. Short forms such as `proxyID=istio-ingressgateway` no longer match.
- **[breaking]** `1.29` end of life
  - Applies if you use `1.29`.
  - This is the final `1.29` release because `1.29` reached end of life on October 15, 2026.

## Other recorded changes
- 13 (defect_corrected 10, added 2, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/istio/1.29.9)

[Original release notes](https://github.com/istio/istio/releases/tag/1.29.9)