# Istio 1.31.3

> Networking & Messaging · 2026-10-22

A security-focused maintenance release removes trust in compromised certificate authorities and updates security-sensitive certificate validation dependencies. It also fixes operator-visible defects, while the ambient readiness check remains opt-in.

## Action needed
- **[security]** Compromised eMudhra CA trust removal
  - Trust in compromised eMudhra intermediate CA certificates was removed from the CA bundle in the Ubuntu-based and distroless images. The bundle no longer includes `emSign ECC Root CA - G3`.
- **[security]** `CVE-2026-111943` certificate-chain rejection
  - `Go` was updated to 1.26.10 in `istiod`, `istioctl`, and `pilot-agent`. The update rejects certificate chains containing any of the compromised eMudhra intermediate keys.
- **[security]** The `rustls-webpki` version in `ztunnel`, updated
  - `rustls-webpki` in `ztunnel` was updated to 0.103.16. The update rejects certificate chains containing any of the compromised eMudhra intermediate keys.

## Other recorded changes
- 4 (defect_corrected 4)

[Full analysis](https://ratatosk.io/en/releases/istio/1.31.3)

[Original release notes](https://github.com/istio/istio/releases/tag/1.31.3)