1.28.5

Solo build of Istio version 1.28.5 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.4 and 1.28.5.

Security Notice

Envoy CVEs

• CVE-2026-26308: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header.
• CVE-2026-26311: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions.
• CVE-2026-26310: (CVSS score 5.9, Medium): Fixed a crash in Utility::getAddressWithPort when called with a scoped IPv6 address (e.g., fe80::1%eth0).
• CVE-2026-26309: (CVSS score 5.3, Medium): Fixed an off-by-one write in JsonEscaper::escapeString() that could corrupt the string null terminator.
• CVE-2026-26330: (CVSS score 5.3, Medium): Fixed a bug in the gRPC rate limit client that could lead to potential use-after-free issues. Only affects Istio 1.28 and 1.29.

Istio CVEs

• CVE-2026-31838 / GHSA-974c-2wxh-g4ww: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access.
• CVE-2026-31837 / GHSA-v75c-crr9-733c: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys.

Other Istio Security Fixes

• Fixed XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration.
• Fixed potential SSRF in WasmPlugin image fetching by validating bearer token realm URLs.
• Fixed HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.

General Changes

• Built against upstream Istio commit 58f61455f0368f692834cb06c8ca6a170e83ba84. Compare.

Solo Flavor Changes

• Added a check to istioctl multicluster check validation to ensure all Istio proxy containers and all sidecar-injector ConfigMap templates have the ISTIO_META_NETWORK environment variable set to match the network label on the istio-system namespace.

• Added check to istioctl multicluster check to verify ambient.dnsCapture is enabled in istio-cni-config ConfigMap.

• Added check to istioctl multicluster check to verify topology.istio.io/cluster label is present and valid on istio-remote gateways.

• Fixed the istioctl multicluster check pod check to dynamically discover eastwest gateway names from Gateway objects instead of hardcoding istio-eastwest.

• Fixed an issue where, when waypoint interop was enabled, ingress gateways applied the waypoint’s DestinationRule instead of the service’s own DestinationRule regardless of whether the service had the istio.io/ingress-use-waypoint label set. The label is now correctly honored.

• Fixed ingress-use-waypoint label propagation from namespace to federated service.

FIPS Flavor Changes

No changes in this section.