Cloud Native

Istio 1.30.4 (ISTIO-SECURITY-2026-006) — Envoy CVEs, EnvoyFilter DoS & sidecar TLS fail-open fixes

Istio 1.30.4 (ISTIO-SECURITY-2026-006) fixes multiple Envoy CVEs and two issues: an EnvoyFilter control-plane DoS and a sidecar TLS fail-open risking plaintext.

August 29, 2026·3 min read·AI researched · AI written · AI reviewed

Istio just shipped a patch that should be on every platform team's radar: ISTIO-SECURITY-2026-006 paired with Istio 1.30.4 addresses a large set of Envoy CVEs (notably CVE-2026-73513 and CVE-2026-73552) and fixes two operationally serious issues — an EnvoyFilter control-plane DoS and a BackendTLSPolicy fail-open behavior in sidecars. The advisory lists affected versions 1.29.0–1.29.6 and 1.30.0–1.30.3 and assigns a combined impact around CVSS 7.7.

This isn't a routine minor patch. The EnvoyFilter control-plane DoS points at an attack surface that lives at the junction of policy injection and mesh control logic: misbehaving or specially crafted filters can tie up control-plane resources and create cluster-wide availability hits. The sidecar TLS fail-open is worse for multi-tenant or service-mesh-as-PLATFORM setups — sidecars that fall back to fail-open TLS semantics can let plaintext or otherwise unauthenticated traffic traverse when you'd expect mTLS gates to be enforced.

If you run Istio-managed clusters in anything resembling shared infrastructure (multiple teams, namespaces, or customer workloads), treat this release as high priority. Rolling to 1.30.4 or applying compensating configuration — tightening EnvoyFilter use, auditing DestinationRule and PeerAuthentication objects, and isolating control-plane access — should be on the playbook this week. This is squarely the kind of bug that bites teams who assume the mesh enforces invariants by default.

The release also included doc and metrics corrections across the 1.30 line, which matters: when you're debugging latency and resource pressure from control-plane interactions, accurate metrics and clear docs are the difference between a clean remediation and an 02-level fire drill.

Grafana: AI features at scale, and a growth signal

On the observability side, Grafana Labs released Grafana v13.3.0 and announced multiple Grafana Cloud GA features — Database Observability AI and expanded Alerting among them — while also noting a recent growth milestone. The technical churn in 13.x also brings integrations and updates such as Azure Monitor Metrics changes.

Two implications here. First, Grafana's AI-assisted features are moving quickly from experiments to productized workflows. Database Observability AI is intended to help triage query plans, suggest likely root causes, and accelerate diagnosis. Second, more automation in alerting and root-cause assistance increases your platform's dependency on vendor-side ML models and interpretation logic — expect different failure modes (false causalities, suggested fixes that miss organizational context) that will require runbook updates.

CNCF and the AI-on-Kubernetes story

The CNCF front page published several AI-focused pieces (Aug 27–28) — predictive autoscaling for GPU workloads, “Is your Kubernetes platform ready for AI?”, and "Building an AI factory on Kubernetes" — that collectively emphasize practical platform concerns: GPU autoscaling, tooling, and operational patterns. Those posts underline CNCF's emphasis on making Kubernetes a first-class platform for AI workloads; expect more guidance and reference architectures aimed at running AI at scale on clusters.

Sources

istioenvoygrafanacncfcloud-native
← All articles
Cloud Native

Flux CD: Declarative Artifact Mirroring with Signature Verification

Flux CD adds declarative mirroring for container images, Helm charts and OCI artifacts with signature verification, provenance policies and minimum artifact age

Aug 28, 2026·3mflux-cdgitops
Cloud Native

Cilium 1.20: eBPF datapath plugins and advanced Gateway API support

Cilium documents an eBPF datapath extension and expands Gateway API support (ExternalAuth, TCPRoute, UDPRoute), making eBPF a first-class platform extension.

Aug 26, 2026·3mciliumebpf
Cloud Native

Cilium 1.20.1 with backports to 1.19/1.18; Argo CD 3.5.1; Kubeflow & Buildpacks graduate to CNCF

Cilium 1.20.1 with backports to 1.19/1.18; Argo CD 3.5.1 lands. Kubeflow and Cloud Native Buildpacks graduate to CNCF, shifting ML and build automation into ops.

Aug 25, 2026·3mciliumargo-cd