RATATOSKRATATOSK
Sign in

Istio

1.30.7Networking & Messaging
Oct 22, 2026

CHECK 3OTHER 3

A security-focused maintenance release removes trust in compromised eMudhra certificates and updates certificate validation in Istio components and images. It also fixes ambient readiness handling, expired self-signed CA renewal, and `istioctl` log filtering.

Check if affected (3)

  • securityTrust in compromised eMudhra intermediate CA certificates removed

    Applies if you use Ubuntu-based or distroless images.

    The CA bundle in Ubuntu-based and distroless images no longer includes emSign ECC Root CA - G3, removing trust in compromised eMudhra intermediate CA certificates. This addresses ISTIO-SECURITY-2026-008.

  • securityGo 1.26.10 certificate-chain validation

    Applies if istiod, istioctl, or pilot-agent runs.

    Go 1.26.10 now rejects certificate chains containing compromised eMudhra intermediate keys in istiod, istioctl, and pilot-agent. This addresses CVE-2026-111943 and ISTIO-SECURITY-2026-008.

  • securityrustls-webpki update in ztunnel

    Applies if ztunnel runs.

    rustls-webpki in ztunnel was updated to 0.103.16, which rejects certificate chains containing compromised eMudhra intermediate keys. This addresses ISTIO-SECURITY-2026-008.

All 3 other recorded changesfixes 3

fixes (3)

  • - Fixed the ambient node-untaint controller removing the cni.istio.io/not-ready taint when only istio-cni was ready. It can now also wait for ztunnel to be ready on the node, so pods are not scheduled onto a node whose ztunnel is still wedged. This is off by default on this release branch and is enabled with PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true . Only applies when ambient is enabled. ( Issue #52073 )
  • - Fixed istiod failing to start when the self-signed CA certificate in istio-ca-secret has expired, which can happen when the deployment is scaled to zero for longer than the certificate TTL. The expired certificate is now automatically renewed using the existing private key.
  • - Fixed istioctl bug-report --duration not filtering logs when used without --end-time .
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →