diff --git a/.changelog/10621.txt b/.changelog/10621.txt
new file mode 100644
index 0000000000..1fed806f26
--- /dev/null
+++ b/.changelog/10621.txt
@@ -0,0 +1,3 @@
+```release-note:security
+xds: ensure envoy verifies the subject alternative name for upstreams [CVE-2021-32574](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32574)
+```
\ No newline at end of file