Istio 1.28.5 is a security-focused patch release addressing multiple CVEs. Key fixes include a high-severity JWKS resolver failure that could allow authentication bypass using known default keys (CVSS 8.7), a medium-severity cross-namespace proxy data access issue via debug endpoints (CVSS 6.9), an SSRF vulnerability in WasmPlugin image fetching, and five Envoy CVEs including a multivalue header bypass in RBAC (CVSS 7.5). The release also adds namespace-based authorization controls for debug endpoints via the DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES configuration option, and fixes an InferencePool configuration loss bug during VirtualService merging.
Sort: