This release note describes what’s different between Solo builds of Istio versions 1.27.5-patch0 and 1.27.7.

Security Notice

  • CVE-2025-61732 (CVSS score 8.6, High): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
  • CVE-2025-68121 (CVSS score 4.8, Moderate): A flaw in crypto/tls session resumption allows resumed handshakes to succeed when they should fail if ClientCAs or RootCAs are mutated between the initial and resumed handshake. This can occur when using Config.Clone with mutations or Config.GetConfigForClient. As a result, clients may resume sessions with unintended servers, and servers may resume sessions with unintended clients.

General Changes

Solo Flavor Changes

  • Added support to retrieve connections from east-west gateway via the istioctl ztunnel-config connections subcommand.

  • Added enhanced validation checks in istioctl multicluster check for flat network configurations.

  • Added support for the east-west gateway to break connections to pods that are terminated.

  • Added the ability to specify authorized namespaces for debug endpoints when ENABLE_DEBUG_ENDPOINT_AUTH=true. Enable by setting DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES to a comma separated list of authorized namespaces. The system namespace (typically istio-system) is always authorized.

  • Fixed the istioctl bootstrap command to respect the -i istio system namespace flag.

  • Fixed the istioctl ecs add-service command to respect the -i istio system namespace flag.

FIPS Flavor Changes

No changes in this section.