# Istio 1.31.1

> Networking & Messaging · 2026-09-21

A maintenance and security release fixes several security flaws and correctness issues. It also improves performance and updates Kiali.

## Check if affected
- **[security]** `BackendTLSPolicy` plaintext fallback
  - Applies if you use `BackendTLSPolicy`.
  - `GHSA-qm8v-g4f9-qhjx` fixes `BackendTLSPolicy` failing open to plaintext on sidecar proxies when its CA reference is unresolved.
- **[security]** Sanitized multicluster kubeconfigs in `istioctl analyze`
  - Applies if you use `istioctl analyze`.
  - `istioctl analyze` no longer builds Kubernetes clients directly from `istio-system` multicluster secrets without sanitizing the kubeconfig. The kubeconfig is sanitized in the same way as `istiod`, preventing crafted secrets from running an exec credential plugin or using other unsafe authentication fields on the machine running `istioctl`.
- **[security]** `istio.io/use-waypoint-canary` namespace isolation
  - Applies if you use `istio.io/use-waypoint-canary` and `serviceEntryVisibility`.
  - The `istio.io/use-waypoint-canary` label no longer bypasses `serviceEntryVisibility` `NAMESPACE` isolation. A canary waypoint now receives the same cross-namespace refusal as the primary waypoint.
- **[security]** SSRF protection for `jwksUri` fetching
  - Applies if you use `jwksUri`.
  - `istiod` now blocks link-local and known cloud metadata addresses at the dial level when fetching `jwksUri` values, and rejects responses that are not valid JWKS. Private and loopback ranges remain reachable and can be blocked with `BLOCKED_CIDRS_IN_JWKS_URIS`.
- **[security]** Escaped `sidecar.istio.io/*` annotations
  - Applies if you use `sidecar.istio.io/*` annotations.
  - The `sidecar.istio.io/*` annotations `proxyImage`, `bootstrapOverride`, `logLevel`, `componentLogLevel`, and `agentLogLevel` are now escaped at every template sink. This prevents crafted annotation values from injecting fields into generated pod or deployment specifications.

## Other recorded changes
- 22 (defect_corrected 20, value_changed 2)

[Full analysis](https://ratatosk.io/en/releases/istio/1.31.1)

[Original release notes](https://github.com/istio/istio/releases/tag/1.31.1)