# Istio 1.30.8

> Networking & Messaging · 2026-11-06

A security-heavy maintenance release with fixes for disclosed advisories affecting ambient mode, authorization policies, multicluster secret delivery, connection tracking, `istiod`, and `ztunnel`. It also contains additional correctness fixes and introduces no newly announced operator migration or configuration requirements.

## Check if affected
- **[security]** `GHSA-rr2c-p22p-6r9r` and ambient `PeerAuthentication` enforcement
  - Applies if you use ambient mode with a mesh-wide STRICT policy, a port-level STRICT `PeerAuthentication`, and a workload in PERMISSIVE or DISABLE mode.
  - In ambient mode, a port-level STRICT `PeerAuthentication` could be skipped when the workload mode was PERMISSIVE or DISABLE under a mesh-wide STRICT policy, allowing plaintext traffic to reach a port that required mTLS. This release corrects the operator-precedence error.
- **[security]** `GHSA-7m6f-j3gp-2r53` and `AuthorizationPolicy` host matching
  - Applies if you use `AuthorizationPolicy` conditions on `request.headers[:authority]` or `request.headers[host]`.
  - `AuthorizationPolicy` conditions on `request.headers[:authority]` or `request.headers[host]` were matched case-sensitively, allowing requests with differently cased hosts to bypass the policy. This release makes the matching behavior correct.
- **[security]** `GHSA-cxwg-46mx-q8hf` and stale conntrack entries
  - Applies if a new inbound connection reuses the 4-tuple of a torn-down connection.
  - A new inbound connection reusing the 4-tuple of a torn-down connection could bypass the sidecar proxy by matching a stale conntrack ESTABLISHED entry. This release fixes the stale connection-tracking behavior.
- **[security]** `GHSA-635j-qv98-9275` and `istio.io/debug` resource parsing
  - Applies if a workload with a mesh identity sends an `istio.io/debug` xDS request.
  - A workload with a mesh identity could crash `istiod` by sending an `istio.io/debug` xDS request whose resource name failed URL parsing, leaving the control plane in a crash loop for the mesh. This release fixes the invalid resource-name handling.
- **[security]** `GHSA-8jw7-82jp-wr2c` and ambient `AuthorizationPolicy` validation
  - Applies if you use ambient mode with an `AuthorizationPolicy` containing an empty `to` or `from` entry.
  - In ambient mode, an `AuthorizationPolicy` with an empty `to` or `from` entry could cause `istiod` to crash and crash-loop until the policy was removed, stopping config distribution for the mesh. This release fixes the handling of the invalid policy.
- **[security]** `GHSA-gf6w-6mxv-5fj4` and multicluster `CLUSTER_ID` validation
  - Applies if you use a multicluster installation.
  - In multicluster installations, a proxy could claim another cluster's `CLUSTER_ID` and receive that cluster's `kubernetes://` secrets over SDS. This release fixes the cluster identity handling.
- **[security]** `GHSA-77vw-rg85-wx5x` and `ztunnel` `traceparent` parsing
  - Applies if `ztunnel` parses a 55-byte `traceparent` header without four dash-separated fields.
  - `ztunnel` panicked when parsing a 55-byte `traceparent` header without four dash-separated fields, terminating the inbound HBONE connection task and dropping every stream multiplexed on that connection. This release fixes the header parsing behavior.

## Other recorded changes
- 15 (defect_corrected 15)

[Full analysis](https://ratatosk.io/en/releases/istio/1.30.8)

[Original release notes](https://github.com/istio/istio/releases/tag/1.30.8)