# Istio 1.30.7

> Networking & Messaging · 2026-10-22

A security-focused maintenance release removes trust in compromised eMudhra certificates and updates certificate validation in Istio components and images. It also fixes ambient readiness handling, expired self-signed CA renewal, and `istioctl` log filtering.

## Check if affected
- **[security]** Trust in compromised eMudhra intermediate CA certificates removed
  - Applies if you use Ubuntu-based or distroless images.
  - The CA bundle in Ubuntu-based and distroless images no longer includes `emSign ECC Root CA - G3`, removing trust in compromised eMudhra intermediate CA certificates. This addresses `ISTIO-SECURITY-2026-008`.
- **[security]** `Go` 1.26.10 certificate-chain validation
  - Applies if `istiod`, `istioctl`, or `pilot-agent` runs.
  - `Go 1.26.10` now rejects certificate chains containing compromised eMudhra intermediate keys in `istiod`, `istioctl`, and `pilot-agent`. This addresses `CVE-2026-111943` and `ISTIO-SECURITY-2026-008`.
- **[security]** `rustls-webpki` update in `ztunnel`
  - Applies if `ztunnel` runs.
  - `rustls-webpki` in `ztunnel` was updated to `0.103.16`, which rejects certificate chains containing compromised eMudhra intermediate keys. This addresses `ISTIO-SECURITY-2026-008`.

## Other recorded changes
- 3 (defect_corrected 3)

[Full analysis](https://ratatosk.io/en/releases/istio/1.30.7)

[Original release notes](https://github.com/istio/istio/releases/tag/1.30.7)