Istio 1.31.4 and 1.30.8: Fix Ambient Plaintext Bypass Flaw

Istio 1.31.4: Closes a Plaintext Bypass for Ambient PeerAuthentication #

Ambient Mode Skips Port-Level STRICT PeerAuthentication #

The ISTIO-SECURITY-2026-009 advisory rates GHSA-rr2c-p22p-6r9r at CVSS 8.2, High, and describes the flaw in one sentence.

…an operator-precedence error let a port-level STRICT PeerAuthentication be skipped when the workload mode was PERMISSIVE or DISABLE under a mesh-wide STRICT policy.

ISTIO-SECURITY-2026-009

Ambient users are potentially impacted if they use PeerAuthentication. Under a mesh-wide STRICT policy, a workload in PERMISSIVE or DISABLE mode could let plaintext reach a port that requires mTLS, which is the exposure the flaw describes. The fixed releases are 1.31.4 for the 1.31 line and 1.30.8 for the 1.30 line. Ravikanth Reddy is credited with the report. Before upgrading, list the port-level STRICT policies in your ambient namespaces, because those are the rules the flaw skipped.

Authorization Policy Host Matching and Source IP Conditions #

GHSA-7m6f-j3gp-2r53 (CVSS 6.5, Moderate) affected AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host] when they were matched case-sensitively, so a request with a differently-cased host could bypass the rule. In Announcing Istio 1.31.4, these conditions are matched case-insensitively, the same as hosts. This suggests that rules written for one exact host casing are the ones to review after the upgrade. Credit goes to @akoul.

GHSA-9gqj-583v-mpqp (CVSS 5.6, Moderate) is a separate policy problem. ipBlocks, notIpBlocks and source.ip on ambient waypoints, and on sidecars receiving HBONE traffic, matched the Envoy internal listener address instead of the client IP, so DENY rules on these fields could fail open. The 1.31.4 fix for ipBlocks and notIpBlocks matching on these listeners uses the downstream client's direct remote IP. Until you upgrade, the advisory's workaround is to use remoteIpBlocks, notRemoteIpBlocks and remote.ip; the search below finds the fields to change.

grep -rnE "ipBlocks|notIpBlocks|source\.ip|request\.headers\[(host|:authority)\]" ./policies/

Sidecar Interception Rule Order #

GHSA-cxwg-46mx-q8hf (CVSS 7.4, High) lets a new inbound connection that reuses the 4-tuple of a torn-down connection bypass the sidecar proxy by matching a stale conntrack ESTABLISHED entry. The exposure applies to sidecar traffic interception with iptables or nftables. Release 1.31.4 evaluates a SYN-only rule ahead of the ESTABLISHED divert rule in both modes. Confirm which interception mode your sidecars use before upgrading. Credit goes to @ramaraochavali, @akshayreddyb, @Pawan-Bishnoi, and @deveshkandpal1224.

istiod Crash Paths from Debug xDS Requests and Empty Policy Entries #

GHSA-635j-qv98-9275 (CVSS 7.7, High) lets any workload with a mesh identity crash istiod by sending an istio.io/debug xDS request whose resource name fails URL parsing. The advisory notes that this leaves the control plane in a crash loop for the whole mesh, and all installations are potentially impacted. In 1.31.4 the request is rejected with InvalidArgument. The reporter is Alon Lerner of Checkmarx Research.

GHSA-8jw7-82jp-wr2c (CVSS 6.3, Moderate) concerns ambient mode. An AuthorizationPolicy with an empty to or from entry, which the validating webhook did not reject, made istiod crash until the policy was removed, stopping config distribution for the mesh. Such entries are now treated as an empty operation or source, matching the sidecar behavior. Find these policies before upgrading, and after the upgrade confirm istiod is not in a crash loop.

Multicluster Secret Access and ztunnel Traceparent Panic #

GHSA-gf6w-6mxv-5fj4 (CVSS 6.3, Moderate) affects multicluster installations, where a proxy could claim another cluster's CLUSTER_ID and receive that cluster's kubernetes:// secrets over SDS. istiod no longer accepts a node metadata CLUSTER_ID that differs from the cluster the proxy's token was validated against. Multicluster operators should check their proxies' CLUSTER_ID values after upgrading, because istiod now rejects mismatches. The reporter is Yonghwa Lee (Xint by Theori).

GHSA-77vw-rg85-wx5x (CVSS 6.5, Moderate) affects ambient mode. ztunnel panicked on a 55-byte traceparent header that lacked four dash-separated fields, which one malformed header drops every stream multiplexed on the inbound HBONE connection. Headers of the correct length with an invalid field layout were also accepted. Invalid traceparent headers are now ignored and a new trace ID is generated, so this suggests that trace continuity breaks for clients that send malformed headers. Credit goes to @RaphaelFakhri.

JWKS Background Refresh Validation #

The JWKS resolver's periodic background refresh cached a fetched response without checking that it looked like a JWKS. The synchronous fetch path already rejected responses not shaped like {"keys": [...]}, and the background refresh now applies the same check. This prevents a RequestAuthentication jwksUri pointed at an unintended internal endpoint from having its response cached and served as a JWKS. Reporters are Anthropic and Ada Logics. Review jwksUri values in RequestAuthentication resources after upgrading.

Ambient East-West Gateway Passthrough Listeners #

1.31.4 adds AUTO_PASSTHROUGH listeners on ambient east-west gateways, which use the istio-east-west GatewayClass. A TLS passthrough listener on port 15443, or on any port using the gateway.istio.io/listener-protocol: auto-passthrough option, now serves sidecar multi-network traffic alongside the HBONE listener. A mixed ambient and sidecar mesh therefore no longer needs two east-west gateways per cluster. This requires AMBIENT_ENABLE_MULTI_NETWORK to be enabled, so consolidating gateways is a deliberate change for mixed meshes.

Config Push Changes for CA ConfigMaps, EndpointSlices and Istio Metadata #

An Istio 1.31 regression made changes to a ConfigMap containing CA certificates, such as kube-root-ca.crt, trigger CDS, LDS, RDS and NDS pushes to every proxy, so clusters were rebuilt in full. In 1.31.4 these updates trigger SDS pushes, and EDS is skipped for them as well. Metadata-only EndpointSlice updates, such as a GitOps tool writing an annotation, no longer trigger an EDS push when endpoints are unchanged, including the push to every proxy for headless Services with non-HTTP ports.

Metadata-only updates to Istio config resources also changed. A push now happens only when the spec or the value of an istio.io label or annotation changes. GitOps tools that write other annotations to these resources should no longer cause pushes, so check how your tooling writes annotations after the upgrade.

Telemetry and Metric Label Changes #

1.31.4 changes the source_app and destination_app metric labels to use the app pod label when a pod also has app.kubernetes.io/name. Since 1.29.1 they had used app.kubernetes.io/name, which 1.31.4 treats as a regression (Issue #62280). This suggests that dashboards or alerts filtering on these labels may show different values after the upgrade, so review those queries first.

A Telemetry resource in a waypoint's own namespace, selected by targetRefs or selector, was not applied when the waypoint served a Service in another namespace. Access logging, metrics and tracing configured this way were silently dropped for every such cross-namespace Service (Issue #61538). Check Telemetry resources in waypoint namespaces that select cross-namespace Services.

Also in this release #

• istio-cni owned CNI config: istioOwnedCNIConfigFileName is respected, Helm updates restart istio-cni, and uninstall and filename changes clean up the owned and primary CNI config.
• istio-cni: an ambient pod deleted with its namespace no longer leaves its ztunnel proxy and host probe ipset entry behind.
• istiod: no panic when outlierDetection is applied to a dynamic forward proxy wildcard cluster (Issue #61450).
• istiod: tolerates a custom taint.name in place of the default cni.istio.io/not-ready taint (Issue #52073).
• JWKS: fetching the JWKS no longer blocks xDS generation (Pull Request #62486).
• Full list: Announcing Istio 1.31.4.

Istio 1.30.8: Mitigation Target for Advisories Affecting 1.30.0 to 1.30.7 #

ISTIO-SECURITY-2026-009 lists 1.30.0 to 1.30.7 as affected releases and gives 1.30 users one mitigation: upgrade to 1.30.8 or later. The advisory's impact sections are written by feature, and this suggests the same feature checks described for 1.31.4 apply on the 1.30 line. The advisory is the source for 1.30.8 in this article, and it is linked in the first paragraph above.

The 1.30.8 release notes are not among the provided sources, so this article cannot list the changes in 1.30.8 beyond the advisories; read those notes before upgrading 1.30 installations.

Upgrade checklist #

Run steps 1 to 4 before the upgrade, then move to 1.31.4 or 1.30.8.

1. List the port-level STRICT PeerAuthentication resources in ambient namespaces, and the workloads in PERMISSIVE or DISABLE mode under a mesh-wide STRICT policy (GHSA-rr2c-p22p-6r9r).
2. Run the grep search shown above over your policy manifests, and review AuthorizationPolicy to or from entries that are empty (GHSA-8jw7-82jp-wr2c).
3. In policies that apply to waypoints or to sidecars receiving HBONE traffic, change ipBlocks, notIpBlocks and source.ip to remoteIpBlocks, notRemoteIpBlocks and remote.ip.
4. Confirm whether sidecar interception uses iptables or nftables, and whether the installation is multicluster.
5. Upgrade 1.31 installations to 1.31.4 or later, and 1.30 installations to 1.30.8 or later.
6. After the upgrade, confirm istiod is running and not in a crash loop.
7. Review queries and alerts that filter on source_app and destination_app, and Telemetry resources in waypoint namespaces that select cross-namespace Services.