Istio 1.27.8 is a security-focused patch release addressing multiple CVEs. Key fixes include a high-severity JWKS resolver failure that could allow authentication bypass using known default keys (CVSS 8.7), a medium-severity cross-namespace proxy data access issue via debug endpoints (CVSS 6.9), a potential SSRF in WasmPlugin image fetching, and four Envoy CVEs including a multivalue header bypass in RBAC (CVSS 7.5). The release also adds support for specifying authorized namespaces for debug endpoints via the DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES configuration option.
Sort: