RATATOSKRATATOSK
Sign in

Istio

1.30.4Networking & Messaging
Aug 27, 2026

ACTION 2CHECK 16OTHER 15

A security-focused maintenance release with multiple Envoy and Istio vulnerability fixes. It also contains reliability, correctness, validation, and behavior changes that may affect operators using the associated protocols, extensions, policies, or configuration fields.

Action needed (2)

  • securityCVE-2026-73551 and URL path normalization

    CVE-2026-73551 is fixed: URL normalization now handles dot and dot-dot path segments with parameters correctly. The fix ships in this release.

  • securityCVE-2026-73511 and per-segment path matching

    CVE-2026-73511 is fixed: path matching now handles per-segment parameters correctly. The fix ships in this release.

Check if affected (16)

  • securityCVE-2026-73513 and the oghttp2 heap use-after-free

    Applies if you use HTTP/2.

    CVE-2026-73513 is fixed: oghttp2 no longer has a heap use-after-free when HTTP/2 trailers arrive without the END_STREAM flag. The fix ships in this release.

  • securityCVE-2026-73552 and negative-match RBAC safe_regex handling

    Applies if you configure safe_regex.

    CVE-2026-73552 is fixed: safe_regex no longer fails open on non-UTF-8 header bytes in negative-match RBAC policies. The fix ships in this release.

  • securityCVE-2026-73512 and the QUIC HTTP datagram handler

    Applies if you use the QUIC HTTP datagram handler.

    CVE-2026-73512 is fixed: the QUIC HTTP datagram handler no longer has a use-after-free. The fix ships in this release.

  • securityCVE-2026-73547 and ext_authz CONNECT request handling

    Applies if you use ext_authz.

    CVE-2026-73547 is fixed: ext_authz no longer terminates abnormally when handling CONNECT requests without a :path header. The fix ships in this release.

  • securityCVE-2026-73549 and scoped IPv6 addresses with HTTP/3

    Applies if you use HTTP/3.

    CVE-2026-73549 is fixed: scoped IPv6 client addresses no longer cause abnormal termination with HTTP/3. The fix ships in this release.

  • securityCVE-2026-50572 and the ext_authz raw HTTP client

    Applies if you use ext_authz.

    CVE-2026-50572 is fixed: the ext_authz raw HTTP client no longer has a use-after-free. The fix ships in this release.

  • securityCVE-2026-73546 and the HTML stats interface

    Applies if you expose the HTML stats interface.

    CVE-2026-73546 is fixed: the HTML stats interface no longer contains the stored cross-site scripting vulnerability. The fix ships in this release.

  • securityCVE-2026-48521 and HTTP/3 connection-pool selection

    Applies if you use HTTP/3.

    CVE-2026-48521 is fixed: ALPN-based HTTP/3 connection-pool selection no longer causes a null-pointer dereference. The fix ships in this release.

  • securityCVE-2026-73548 and generic HTTP upgrades

    Applies if you use generic HTTP upgrades.

    CVE-2026-73548 is fixed: generic HTTP upgrades no longer permit cross-user response poisoning. The fix ships in this release.

  • securityCVE-2026-73550 and duplicate HTTP/2 Host headers

    Applies if you use HTTP/2.

    CVE-2026-73550 is fixed: HTTP/2 no longer permits memory exhaustion through discarded duplicate Host headers. The fix ships in this release.

  • securityCVE-2026-73553 and ignore_path_parameters_in_path_matching

    Applies if you configure ignore_path_parameters_in_path_matching.

    CVE-2026-73553 is fixed: ignore_path_parameters_in_path_matching no longer permits an RBAC bypass. The fix ships in this release.

  • securityGHSA-qm8v-g4f9-qhjx and BackendTLSPolicy CA references

    Applicability is not stated in the release notes.

    GHSA-qm8v-g4f9-qhjx is fixed: BackendTLSPolicy no longer fails open to plaintext on sidecar proxies when its CA reference is unresolved. The fix ships in this release.

  • securityThe ENABLE_XDS_API_GENERATOR_AUTH default

    Applies if you run the XDS API generator (MCP config serving).

    The XDS API generator for MCP config serving now requires a verified control-plane identity. ENABLE_XDS_API_GENERATOR_AUTH defaults to true; setting it to false disables the requirement for compatibility. The change ships in this release.

  • securityGateway API cross-namespace reference authorization

    Applicability is not stated in the release notes.

    Gateway API authorization now runs before resolving cross-namespace certificateRef or caCertificateRef references. Unauthorized references return RefNotPermitted, so listener ResolvedRefs status no longer reveals whether the referenced Secret or ConfigMap exists. The fix ships in this release.

  • securityRequestAuthentication jwksUri address blocking

    Applies if you configure jwksUri.

    istiod now blocks link-local and known cloud metadata addresses at the dial level when fetching RequestAuthentication jwksUri values, and rejects responses that are not valid JWKS. Private and loopback ranges remain reachable and can be blocked with BLOCKED_CIDRS_IN_JWKS_URIS. The fix ships in this release.

  • securityEscaping for sidecar.istio.io/* injection annotations

    Applies if you configure any of the sidecar.istio.io/* annotations proxyImage, bootstrapOverride, logLevel, componentLogLevel, or agentLogLevel.

    The sidecar.istio.io/* annotations proxyImage, bootstrapOverride, logLevel, componentLogLevel, and agentLogLevel are now escaped at every sidecar and gateway injection template sink. Crafted annotation values can no longer inject additional fields into generated pod or deployment specifications. The fix ships in this release.

All 15 other recorded changesfixes 14 · constraints 1

fixes (14)

  • - Fixed a deadlock where the istio-cni node agent pod could fail to start (for example after a node reboot) because the CNI plugin only skipped the Kubernetes client creation for its own agent pod when ambient mode was enabled. The preemptive check now runs in sidecar mode as well, so the agent pod no longer blocks on a kubeconfig it has not written yet. ( Issue #60668 )
  • - Fixed a bug where a remote cluster’s network gateway could disappear from cross-network routing after credential rotation and not recover until istiod restarted. The in-place registry swap now re-wires the new registry to the aggregate controller’s handlers so its future gateway and service events propagate, and reloads gateways once to pick up those discovered during the pre-swap sync. ( Issue #60920 )
  • - Fixed an issue in multicluster deployments where rotating a remote cluster’s istio-remote-secret could permanently wipe endpoint shards for services with stable endpoints in that cluster, making them unreachable across clusters until istiod was restarted. ( Issue #61043 )
  • - Fixed a race condition on istiod startup where the readiness probe could report ready before the dedicated injection and validation webhook server ( --httpsAddr , default :15017 ) was accepting connections, causing intermittent failed calling webhook timeouts when creating resources immediately after istiod became ready. This does not affect deployments where webhooks share the main HTTP server (empty --httpsAddr ). ( Issue #61049 )
  • - Fixed an issue where ingress gateways bypassed waypoint proxies for multi-cluster services when remote workloads were on a different network, causing authorization policies to not be enforced. ( Issue #61092 )
  • - Fixed an issue where gateway proxy Deployment resources could permanently fail to be created during istiod startup. ( Issue #61095 )
  • - Fixed an issue where a pod selected by a ServiceEntry workloadSelector could start up missing that service from its sidecar’s inbound configuration. Traffic to the port was not handled as the protocol declared in the ServiceEntry , and port-level PeerAuthentication was not applied. The pod did not recover on its own; only restarting istiod repaired it. ( Issue #61157 )
  • - Fixed an issue where istio-cni considered hostNetwork pods eligible for ambient enrollment. ( Issue #61168 )
  • - Fixed a file descriptor leak in the istio-cni node agent: when the procfs scan found more than one network namespace for the same pod, the losing candidate’s netns file descriptor was dropped without being closed, pinning the namespace in the kernel until garbage collection.
  • - Fixed external SDS providers configured through extensionProviders to use the configured service hostname as the gRPC authority.
  • - Fixed a goroutine leak in istiod leader election where every election cycle (leadership lost and re-acquired) leaked one goroutine until process exit. ( Issue #60843 )
  • - Fixed an issue where istiod CPU usage increased as the number of AuthorizationPolicy resources increased. ( Issue #61254 )
  • - Fixed ListenerSet conflict resolution for hostname and protocol conflicts. Conflicting listeners are now correctly rejected and ListenerSet status conditions report in compliance with Gateway API 1.5. ( PR #60775 )
  • - Fixed a bug where a ztunnel reconnect (such as the periodic connection recycle from keepaliveMaxServerConnectionAge ) triggered a full workload (WDS) push. Istiod now assigns each WDS resource a content-based version and, when a reconnecting client reports the versions it already holds via initial_resource_versions , re-sends only resources that changed while the client was disconnected. Older ztunnel versions that do not report versions continue to receive the full set. ( Issue #1966 )

constraints (1)

  • - Fixed an EnvoyFilter validation gap where an uncapped proxyVersion match expression could drive excessive istiod memory and CPU during regex compilation. The match expression is now limited to 1024 characters. Credit : This issue was reported by Artem Cherezov .
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →