L3 · ShartedIstio · Service mesh · Authorizationistio-november-batch

Istio November batch fixes mTLS and policy bypasses, secret disclosure and mesh denial of service

Istio fixes eight advisories plus a JWKS-cache validation issue in 1.31.4 and 1.30.8. Conditional flaws bypass ambient mTLS, authorization or sidecar interception, expose multicluster secrets, and disrupt istiod/ztunnel. A debug-request crash requires a mesh identity. The vendor reports no exploitation in these notices.

Disclosed: Nov 6, 2026; Public disclosure date
Severity: CVSS 8.2 × 1; 8 CVEs tracked here
Splash zone: Istio 1.31.0–1.31.3 and 1.30.0–1.30.7; exposure varies by ambient, HBONE, policy, multicluster and mesh-identity use.; Istio · Service mesh · Authorization
In the wild: Unknown; Reviewed vendor advisory and release notes do not report actual exploitation.

What happened

This is a new Istio advisory batch, distinct from the earlier eMudhra trust-anchor response. The conditions differ: not every installation is exposed to every bypass, and the debug crash requires a valid mesh identity. The JWKS fix validates periodically fetched responses before caching; it is not evidence of a new malicious key or confirmed customer data theft. No victim count or observed attack campaign is established. L3 reflects mainstream service-mesh security boundaries, not confirmed exploitation.

What’s in the bowl

GHSA-rr2c-p22p-6r9rCVSS 8.2

Ambient port-level mTLS bypass

A port-level STRICT PeerAuthentication can be skipped with workload PERMISSIVE/DISABLE under mesh-wide STRICT, allowing plaintext to the protected port.

GHSA-7m6f-j3gp-2r53CVSS 6.5

Host-header authorization bypass

Different letter casing in a host value can bypass AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host].

GHSA-cxwg-46mx-q8hfCVSS 7.4

Stale connection-tracking sidecar bypass

Reusing a torn-down connection’s 4-tuple can match a stale ESTABLISHED entry and bypass sidecar interception with iptables or nftables.

GHSA-635j-qv98-9275CVSS 7.7

Authenticated debug request crashes istiod

A workload with a mesh identity can send an invalid resource name in an istio.io/debug xDS request and crash-loop the mesh control plane.

GHSA-8jw7-82jp-wr2cCVSS 6.3

Empty ambient policy crashes istiod

An ambient AuthorizationPolicy with an empty to/from entry that escapes webhook rejection can crash-loop istiod until the policy is removed.

GHSA-gf6w-6mxv-5fj4CVSS 6.3

Multicluster SDS secret disclosure

A proxy can claim another cluster’s CLUSTER_ID to receive that cluster’s kubernetes:// secrets through SDS.

GHSA-77vw-rg85-wx5xCVSS 6.5

Malformed traceparent drops HBONE streams

A malformed 55-byte traceparent header can terminate an inbound ztunnel HBONE connection task and drop its multiplexed streams.

GHSA-9gqj-583v-mpqpCVSS 5.6

HBONE client-IP DENY rules fail open

On ambient waypoints and sidecars receiving HBONE, ipBlocks/notIpBlocks/source.ip can evaluate the internal listener address, allowing DENY rules to fail open.

Fixed versions

Product	Safe from	Note
Istio 1.31	`1.31.4`
Istio 1.30	`1.30.8`

Crime-scene timeline

Nov 6, 2026
Istio publishes security batch 2026-009 and both fixes
The advisory and release notes cover eight GHSA entries and a separate periodic JWKS-refresh validation fix.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Istio security advisory 2026-009PrimaryEight GHSA entries, topology/policy prerequisites, branch ranges, fixed versions and client-IP workaround.
Istio 1.31.4 release notesPrimaryConfirms the eight fixes, JWKS periodic-refresh validation and control/data-plane-related changes.
Istio 1.30.8 release notesPrimaryConfirms the backported security batch and corresponding fixes on the 1.30 line.

Wipe guide

The wipe checklist

0 of 3 sheets used

Roll out both control-plane and affected data-plane fixesInventory Istio revisions, istiod, sidecar/waypoint proxies, CNI interception and ztunnel components. Follow the official upgrade documentation for 1.31.4 or 1.30.8, including the data-plane rollout, and verify actual component versions rather than only updating a chart or CLI. Test mTLS, authorization, multicluster secret distribution and representative traffic after rollout. The notice does not establish safety of older release lines.
Review the exact policy and topology prerequisitesInspect ambient PeerAuthentication mesh/workload/port combinations, empty AuthorizationPolicy to/from entries, host-header conditions, sidecar interception rules and multicluster identities. For HBONE client-IP rules, the vendor’s workaround is remoteIpBlocks/notRemoteIpBlocks/remote.ip instead of ipBlocks/notIpBlocks/source.ip; test the intended trusted-proxy and client-IP behavior before adopting it. This addresses that policy issue only, not the whole batch.
Preserve evidence and investigate abnormal mesh behaviorReview istiod and ztunnel restarts, rejected/debug xDS requests, unexpected plaintext or denied traffic being accepted, and suspicious cross-cluster SDS access using existing mesh and platform logs. If the empty-policy crash applies, locate/remove the offending empty to/from entry while applying fixes. Scope and rotate secrets only when exposure is established. The notices give no dedicated intrusion indicators; crashes or a matching configuration alone do not prove exploitation.