Istio 1.29.1 is a security-focused patch release addressing multiple CVEs in both Envoy and Istio itself. Key fixes include a high-severity JWKS resolver authentication bypass (CVSS 8.7), cross-namespace proxy data access via debug endpoints (CVSS 6.9), and five Envoy CVEs including a multivalue header RBAC bypass (CVSS 7.5). Security hardening changes include requiring authentication on XDS debug port 15010, enforcing namespace-based authorization on port 15014, and fixing a potential SSRF in WasmPlugin image fetching. Additional bug fixes address Gateway API CORS parsing, waypoint TLS inspector issues, nil pointer dereferences in multi-primary deployments, and istiod crashes in ambient mode.
Sort: