# Istio 1.30.6

> Networking & Messaging · 2026-10-15

A security-focused maintenance release with fixes for vulnerability paths, stricter handling in several security-sensitive components, and broader correctness and reliability work. It also includes changes affecting gateway validation, Kubernetes API request handling, ambient behavior, routing, platform integration, and dependency stability.

## Action needed
- **[security]** Exact `proxyID` matching in `istiod` debug endpoints
  - `istiod` debug endpoints, including `/debug/config_dump`, `/debug/edsz`, and the XDS `istio.io/debug/config_dump` type, now require an exact `proxyID` match. A partial ID no longer lets a caller read another proxy's configuration in the same namespace.

## Check if affected
- **[security]** `GHSA-8vc2-jrm4-835w` in the OAuth2 HTTP filter
  - Applies if you use the OAuth2 HTTP filter.
  - `GHSA-8vc2-jrm4-835w` fixes an unauthenticated remote crash in the OAuth2 HTTP filter when a CONNECT request lacks a `:path` header. The fix ships in the OAuth2 HTTP filter.
- **[security]** `GHSA-47vj-9r25-wv5j` in the `api_key_auth` HTTP filter
  - Applies if you use the `api_key_auth` HTTP filter.
  - `GHSA-47vj-9r25-wv5j` fixes a crash in the `api_key_auth` HTTP filter when a CONNECT request lacks a `:path` header. The fix ships in the `api_key_auth` HTTP filter.
- **[security]** `AuthorizationPolicy` method matching over HTTP/2
  - Applies if you configure `AuthorizationPolicy` and use HTTP/2.
  - `GHSA-w44g-8m76-8gc5` fixes `AuthorizationPolicy` method rules being bypassed over HTTP/2 when the method case changes. The fix ships in HTTP/2 authorization handling.
- **[security]** `istiod` stability for IP-addressed waypoints
  - Applies if you run in ambient mode and configure `ServiceEntry`.
  - `GHSA-7p2q-4xvg-vxc6` fixes an `istiod` crash in ambient mode when a `ServiceEntry` or another service claims the address of an IP-addressed waypoint. The fix ships in ambient-mode `istiod` processing.
- **[security]** Quoted values in `istioctl manifest translate` scripts
  - Applies if you use `istioctl manifest translate` and run its generated install shell scripts.
  - `istioctl manifest translate` now quotes values from IstioOperator input, such as the namespace and release name, in generated install shell scripts. This prevents crafted values from injecting additional shell commands when the scripts run.
- **[security]** `CreateCertificate` error details on the Kubernetes CSR RA path
  - Applies if you configure `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API`.
  - `CreateCertificate` no longer returns raw Kubernetes API error text on the experimental Kubernetes CSR RA path. The change prevents CSR names, signer names, and `istiod`'s identity from being exposed through `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API`.
- **[security]** HTTPS-only fallback behavior for the Wasm OCI image fetcher
  - Applies if you use the Wasm OCI image fetcher.
  - The Wasm OCI image fetcher no longer retries a failed HTTPS fetch over plaintext HTTP based on the registry error. This removes the registry-controlled fallback that could force plaintext transport and serve an arbitrary Wasm binary when no module digest was pinned.
- **[breaking]** `MAX_RA_WORKLOAD_CERT_TTL` certificate lifetime cap
  - Applies if you configure `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API`.
  - Client-requested `ValidityDuration` is now capped by the new `MAX_RA_WORKLOAD_CERT_TTL` environment variable, which defaults to 48h, on the experimental Kubernetes CSR RA path. This replaces the previous allowance up to `MAX_WORKLOAD_CERT_TTL`, which defaults to 90d; deployments that request certificates with a TTL above 48h on this path should raise `MAX_RA_WORKLOAD_CERT_TTL`.

## Other recorded changes
- 16 (defect_corrected 12, added 3, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/istio/1.30.6)

[Original release notes](https://github.com/istio/istio/releases/tag/1.30.6)