1.29.1

This release note describes what’s different between Solo builds of Istio versions 1.29.0 and 1.29.1.

Security Notice link

This release contains fixes to a number of CVEs.

Envoy CVEs link

• CVE-2026-26308: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header.
• CVE-2026-26311: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions.
• CVE-2026-26310: (CVSS score 5.9, Medium): Fixed a crash in Utility::getAddressWithPort when called with a scoped IPv6 address (e.g., fe80::1%eth0).
• CVE-2026-26309: (CVSS score 5.3, Medium): Fixed an off-by-one write in JsonEscaper::escapeString() that could corrupt the string null terminator.
• CVE-2026-26330: (CVSS score 5.3, Medium): Fixed a bug in the gRPC rate limit client that could lead to potential use-after-free issues. Only affects Istio 1.28 and 1.29.

Istio CVEs link

• CVE-2026-31838 / GHSA-974c-2wxh-g4ww: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access.
• CVE-2026-31837 / GHSA-v75c-crr9-733c: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys.

Other Istio Security Fixes link

• Fixed XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration.
• Fixed potential SSRF in WasmPlugin image fetching by validating bearer token realm URLs.
• Fixed HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.

General Changes link

• Built against upstream Istio commit e033c7a0e1575d4732cb2353af7928a052bbfcb3. Compare.

Solo Flavor Changes link

• Added metrics to track mesh config parsing and validation status. New pilot_meshconfig_validation_status and pilot_meshnetworks_validation_status gauges indicate whether the current mesh configuration is valid (0) or invalid (1).

• Added support for loading license keys from mounted volumes. The path where the volume is mounted should be provided as the license.volume Helm value.

• Added a check to istioctl multicluster check validation to ensure all Istio proxy containers and all sidecar-injector ConfigMap templates have the ISTIO_META_NETWORK environment variable set to match the network label on the istio-system namespace.

• Added check to istioctl multicluster check to verify ambient.dnsCapture is enabled in istio-cni-config ConfigMap.

• Added check to istioctl multicluster check to verify topology.istio.io/cluster label is present and valid on istio-remote gateways.

• Fixed the istioctl multicluster check pod check to dynamically discover eastwest gateway names from Gateway objects instead of hardcoding istio-eastwest.

• Fixed a bug where traffic could be non-deterministically routed through a prefer-other ServiceEntry instead of a non-prefer-other ServiceEntry with the same hostname. This could occur when a VirtualService referenced a hostname served by both types of ServiceEntry and there was an explicit sidecar scope that limited the visibility of the non-prefer-other ServiceEntry.

FIPS Flavor Changes link

No changes in this section.