RATATOSKRATATOSK
Sign in

Istio

1.30.6Networking & Messaging
Oct 15, 2026

ACTION 1CHECK 8OTHER 16

A security-focused maintenance release with fixes for vulnerability paths, stricter handling in several security-sensitive components, and broader correctness and reliability work. It also includes changes affecting gateway validation, Kubernetes API request handling, ambient behavior, routing, platform integration, and dependency stability.

Action needed (1)

  • securityExact proxyID matching in istiod debug endpoints

    istiod debug endpoints, including /debug/config_dump, /debug/edsz, and the XDS istio.io/debug/config_dump type, now require an exact proxyID match. A partial ID no longer lets a caller read another proxy's configuration in the same namespace.

Check if affected (8)

  • securityGHSA-8vc2-jrm4-835w in the OAuth2 HTTP filter

    Applies if you use the OAuth2 HTTP filter.

    GHSA-8vc2-jrm4-835w fixes an unauthenticated remote crash in the OAuth2 HTTP filter when a CONNECT request lacks a :path header. The fix ships in the OAuth2 HTTP filter.

  • securityGHSA-47vj-9r25-wv5j in the api_key_auth HTTP filter

    Applies if you use the api_key_auth HTTP filter.

    GHSA-47vj-9r25-wv5j fixes a crash in the api_key_auth HTTP filter when a CONNECT request lacks a :path header. The fix ships in the api_key_auth HTTP filter.

  • securityAuthorizationPolicy method matching over HTTP/2

    Applies if you configure AuthorizationPolicy and use HTTP/2.

    GHSA-w44g-8m76-8gc5 fixes AuthorizationPolicy method rules being bypassed over HTTP/2 when the method case changes. The fix ships in HTTP/2 authorization handling.

  • securityistiod stability for IP-addressed waypoints

    Applies if you run in ambient mode and configure ServiceEntry.

    GHSA-7p2q-4xvg-vxc6 fixes an istiod crash in ambient mode when a ServiceEntry or another service claims the address of an IP-addressed waypoint. The fix ships in ambient-mode istiod processing.

  • securityQuoted values in istioctl manifest translate scripts

    Applies if you use istioctl manifest translate and run its generated install shell scripts.

    istioctl manifest translate now quotes values from IstioOperator input, such as the namespace and release name, in generated install shell scripts. This prevents crafted values from injecting additional shell commands when the scripts run.

  • securityCreateCertificate error details on the Kubernetes CSR RA path

    Applies if you configure EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API.

    CreateCertificate no longer returns raw Kubernetes API error text on the experimental Kubernetes CSR RA path. The change prevents CSR names, signer names, and istiod's identity from being exposed through EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API.

  • securityHTTPS-only fallback behavior for the Wasm OCI image fetcher

    Applies if you use the Wasm OCI image fetcher.

    The Wasm OCI image fetcher no longer retries a failed HTTPS fetch over plaintext HTTP based on the registry error. This removes the registry-controlled fallback that could force plaintext transport and serve an arbitrary Wasm binary when no module digest was pinned.

  • breakingMAX_RA_WORKLOAD_CERT_TTL certificate lifetime cap

    Applies if you configure EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API.

    Client-requested ValidityDuration is now capped by the new MAX_RA_WORKLOAD_CERT_TTL environment variable, which defaults to 48h, on the experimental Kubernetes CSR RA path. This replaces the previous allowance up to MAX_WORKLOAD_CERT_TTL, which defaults to 90d; deployments that request certificates with a TTL above 48h on this path should raise MAX_RA_WORKLOAD_CERT_TTL.

All 16 other recorded changesfixes 12 · additions 3 · defaults 1

fixes (12)

  • - Fixed a panic in istiod when the OIDC/JWT authenticator received a token with a malformed sub claim.
  • - Fixed the Kubernetes CSR watch loop using an abandoned time.After timer that could leave a goroutine running past request completion on the experimental Kubernetes CSR RA path ( EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API ).
  • - Fixed an HTTPRoute rule with several InferencePool backendRefs configuring only one endpoint picker.
  • - Fixed two HTTPRoute s sharing a rules[].name on the same gateway overwriting each other’s endpoint picker.
  • - Fixed a route rule losing its InferencePool endpoint picker when it also carried a CORS filter.
  • - Fixed sidecar proxy UID/GID resolution on OpenShift for workloads bound to a custom SecurityContextConstraint with a narrow or explicitly-configured UID range, which the namespace’s preallocated UID range annotation does not advertise.
  • - Fixed an issue where, with PILOT_FILTER_GATEWAY_CLUSTER_CONFIG enabled, incremental CDS pushes removed gateway clusters for Services listed in the envoyfilter.istio.io/referenced-services annotation of an EnvoyFilter .
  • - Fixed a bug where an internal listener was incorrectly created when the listener is of HTTPS or TLS but without a TLS section defined.
  • - Fixed removing a single event handler from a CRD-backed informer removing every handler on that informer.
  • - Fixed an issue where EDS-irrelevant configuration updates coalesced with an endpoint update caused full EDS generation instead of updating only the affected endpoint assignments.
  • - Fixed ztunnel crash-looping with exit code 133 ( SIGTRAP ) on arm64 nodes whose CPUs provide the RNDR instruction, such as GKE Axion, when the hardware random number generator reported a transient failure. aws-lc-rs is updated to 1.18.2, which retries the read instead of aborting.
  • Fixed an issue where the pre-marshaled workload used for change detection and versioning in ambient was not stable

additions (3)

  • - Improved Added PILOT_ENABLE_STRICT_GATEWAY_MERGING to prevent cross-namespace merging of Istio Gateways with managed GatewayAPI Gateways.
  • - Added a validation warning for ServiceEntry addresses that are catch-all ( 0.0.0.0 , :: ), have an unspecified network ( 0.0.0.0/N , ::/N ), or are a CIDR with a prefix shorter than /8 .
  • Each timeout is logged as a warning and counted by the kube_client_deadline_fired_total metric.

defaults (1)

  • - Fixed Istio components hanging indefinitely when a Kubernetes API request gets no response, for example when a load balancer or proxy silently drops the return path. Previously such a request could stay open forever, stalling the controller that issued it until the process restarted. Requests now time out on the client side, so a stuck request is canceled and the component recovers on its own.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Istio releases →