RATATOSKRATATOSK
Sign in

Istio

1.30.8Networking & Messaging
Nov 6, 2026

CHECK 7OTHER 15

A security-heavy maintenance release with fixes for disclosed advisories affecting ambient mode, authorization policies, multicluster secret delivery, connection tracking, `istiod`, and `ztunnel`. It also contains additional correctness fixes and introduces no newly announced operator migration or configuration requirements.

Check if affected (7)

  • securityGHSA-rr2c-p22p-6r9r and ambient PeerAuthentication enforcement

    Applies if you use ambient mode with a mesh-wide STRICT policy, a port-level STRICT PeerAuthentication, and a workload in PERMISSIVE or DISABLE mode.

    In ambient mode, a port-level STRICT PeerAuthentication could be skipped when the workload mode was PERMISSIVE or DISABLE under a mesh-wide STRICT policy, allowing plaintext traffic to reach a port that required mTLS. This release corrects the operator-precedence error.

  • securityGHSA-7m6f-j3gp-2r53 and AuthorizationPolicy host matching

    Applies if you use AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host].

    AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host] were matched case-sensitively, allowing requests with differently cased hosts to bypass the policy. This release makes the matching behavior correct.

  • securityGHSA-cxwg-46mx-q8hf and stale conntrack entries

    Applies if a new inbound connection reuses the 4-tuple of a torn-down connection.

    A new inbound connection reusing the 4-tuple of a torn-down connection could bypass the sidecar proxy by matching a stale conntrack ESTABLISHED entry. This release fixes the stale connection-tracking behavior.

  • securityGHSA-635j-qv98-9275 and istio.io/debug resource parsing

    Applies if a workload with a mesh identity sends an istio.io/debug xDS request.

    A workload with a mesh identity could crash istiod by sending an istio.io/debug xDS request whose resource name failed URL parsing, leaving the control plane in a crash loop for the mesh. This release fixes the invalid resource-name handling.

  • securityGHSA-8jw7-82jp-wr2c and ambient AuthorizationPolicy validation

    Applies if you use ambient mode with an AuthorizationPolicy containing an empty to or from entry.

    In ambient mode, an AuthorizationPolicy with an empty to or from entry could cause istiod to crash and crash-loop until the policy was removed, stopping config distribution for the mesh. This release fixes the handling of the invalid policy.

  • securityGHSA-gf6w-6mxv-5fj4 and multicluster CLUSTER_ID validation

    Applies if you use a multicluster installation.

    In multicluster installations, a proxy could claim another cluster's CLUSTER_ID and receive that cluster's kubernetes:// secrets over SDS. This release fixes the cluster identity handling.

  • securityGHSA-77vw-rg85-wx5x and ztunnel traceparent parsing

    Applies if ztunnel parses a 55-byte traceparent header without four dash-separated fields.

    ztunnel panicked when parsing a 55-byte traceparent header without four dash-separated fields, terminating the inbound HBONE connection task and dropping every stream multiplexed on that connection. This release fixes the header parsing behavior.

All 15 other recorded changesfixes 15

fixes (15)

  • Fixed the JWKS resolver’s periodic background refresh caching a fetched response without validating that it looks like a JWKS.
  • Fixed an istiod panic when outlierDetection was applied to a dynamic forward proxy (DFP) wildcard cluster.
  • Fixed an issue where the istio-cni Helm chart did not respect the value set for istioOwnedCNIConfigFileName .
  • Fixed an issue where updates to the istio-cni config via the Helm chart did not restart istio-cni to pick up the new values.
  • Fixed an issue where, when uninstalling the istio-cni Helm chart, the owned istio-cni config was not removed or the primary CNI config did not have the istio-cni plugin removed.
  • Fixed an issue where, when enabling the owned istio-cni config, the primary CNI config was not cleaned up.
  • Fixed an issue where, when changing the owned istio-cni config filename, the previous filename was not removed.
  • Fixed the source_app and destination_app metric labels to use the app pod label when a pod also has app.kubernetes.io/name . Since 1.29.1 they had used app.kubernetes.io/name , which is a regression from the intended behavior.
  • Fixed a situation where fetching the JWKS could block xDS generation.
  • Fixed AuthorizationPolicy ipBlocks and notIpBlocks matching on waypoint and sidecar HBONE internal listeners to use the downstream client’s direct remote IP address instead of the internal Envoy address.
  • Fixed an issue where istio-cni skipped cleanup for an ambient pod deleted together with its namespace, leaving its ztunnel proxy and host probe ipset entry behind.
  • Fixed an issue where a metadata-only update to an EndpointSlice , such as a GitOps tool writing an annotation, triggered an EDS push, and for headless Services with non-HTTP ports a push to every proxy, even though the endpoints were unchanged.
  • Fixed istiod only tolerating the default cni.istio.io/not-ready taint. When taint.name is set to a custom taint, the istiod deployment now tolerates that taint, so istiod can be scheduled onto nodes that still carry it.
  • Fixed an issue where a metadata-only update to an Istio config resource, such as a GitOps tool writing an annotation, triggered a push whenever the resource carried any istio.io label or annotation, for example istio.io/rev . A push is now triggered only when the spec or the value of an istio.io label or annotation changes.
  • Fixed a regression where a Telemetry resource in a waypoint’s own namespace, selected by targetRefs or selector , was not applied when the waypoint served a Service in a different namespace.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →