📋 Recommended Actions

⚠️ Action Required
Immediate patching is highly recommended due to multiple critical and high-severity security fixes. Review the new PILOT_ENABLE_STRICT_GATEWAY_MERGING flag to understand its implications for your Gateway API deployments.

📝 Summary

Istio 1.30.6 delivers essential security updates and significant stability improvements. This release addresses multiple critical vulnerabilities, including shell injection in istioctl manifest translate and potential MITM attacks on istioctl XDS connections. It also resolves Denial-of-Service issues related to ambient waypoint address collisions and malformed OIDC/JWT sub claims, along with a WASM image fetcher vulnerability. Beyond security, you’ll find enhanced Gateway API reliability, particularly for InferencePool backendRefs and ListenerSets. Kubernetes API requests now benefit from client-side timeouts, preventing indefinite hangs and boosting control plane resilience. OpenShift users will see more accurate proxy UID/GID assignments. Upgrade swiftly to secure your mesh and leverage these robustness gains.

🔒 Critical Security Updates & Hardening

🔒 Security Advisory
CVE ID: GHSA-w44g-8m76-8gc5, GHSA-qm8v-g4f9-qhjx, GHSA-7p2q-4xvg-vxc6
CVSS Score: 9.0 (Critical)

This release includes a comprehensive suite of security fixes, addressing several critical and high-severity vulnerabilities across various components. These updates are crucial for maintaining the integrity, availability, and confidentiality of your service mesh, protecting against potential data breaches, denial-of-service attacks, and privilege escalation.

Multiple areas have been hardened:

  • Shell Injection in istioctl manifest translate: Previously, unquoted values from IstioOperator input could allow crafted values to inject additional shell commands into generated install scripts. This is now fixed by escaping arguments with shellescape.Quote.
  • istioctl XDS Certificate Verification: istioctl now properly verifies the istiod certificate when connecting to XDS with a service account token, preventing Man-in-the-Middle (MITM) attacks. This applies to proxy-status, x internal-debug, and --xds-address in general. Verification uses the Istio root certificate from istio-ca-root-cert or the configured --authority.
  • AuthorizationPolicy Method Case-Insensitivity: Method matching in AuthorizationPolicy is now case-insensitive, closing a bypass vulnerability (e.g., post for POST) over HTTP/2. This prevents attackers from bypassing access controls by altering header casing.
  • BackendTLSPolicy Fail-Open Fix: A critical fix addresses a fail-open issue where sidecar proxies would send upstream traffic in plaintext instead of failing closed if a BackendTLSPolicy’s caCertificateRefs could not be resolved. This ensures secure communication is enforced as intended.
  • Ambient Waypoint Address Collision DoS: Istiod no longer crashes when an IP-addressed waypoint’s address is claimed by another service (e.g., a ServiceEntry), preventing a denial-of-service vulnerability that could be exploited by low-privileged tenants.
  • OIDC/JWT Authenticator Panic Fix: A panic in istiod caused by malformed sub claims in OIDC/JWT tokens has been resolved, enhancing the stability of authentication services.
  • Kubernetes CSR RA Hardening: Enhancements to the experimental Kubernetes CSR RA path (EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API) prevent raw API error leakage, goroutine leaks, and cap certificate TTLs to 48 hours by default via MAX_RA_WORKLOAD_CERT_TTL to limit the blast radius of stolen istio-tokens.
  • Wasm Image Fetcher HTTPS Downgrade: The Wasm OCI image fetcher will no longer retry failed HTTPS fetches over plaintext HTTP based solely on registry errors. Plaintext fallback is now strictly limited to registries explicitly allowlisted by the operator via WASM_INSECURE_REGISTRIES, mitigating MITM risks.
  • istiod Debug Endpoints Exact proxyID Matching: Debug endpoints like /debug/config_dump and /debug/edsz now require an exact proxyID match (e.g., <pod>.<namespace>), preventing information disclosure by partial ID matching within a namespace.
  • HTTP/2 CVEs: An update to golang.org/x/net addresses several upstream HTTP/2 Common Vulnerabilities and Exposures, improving the overall security posture of HTTP/2 communication within the mesh.
  • Strict Gateway Merging: A new PILOT_ENABLE_STRICT_GATEWAY_MERGING flag (defaulting to false in 1.30, true in 1.31) has been introduced. When enabled, it prevents cross-namespace merging of Istio Gateways with managed GatewayAPI Gateways, mitigating potential credential leakage or privilege escalation risks by isolating Gateway configurations.

Source:

  • operator/cmd/mesh/manifest-translate.go (144-152)
  • istioctl/pkg/xds/client.go (101-104)
  • istioctl/pkg/multixds/gather.go (194-200)
  • pilot/pkg/security/authz/matcher/header.go (40-41)
  • pilot/pkg/security/authz/model/generator.go (361-365)
  • releasenotes/notes/backendtlspolicy-sidecar-failclosed.yaml (8-13)
  • pilot/pkg/serviceregistry/ambient/sidecar_interop.go (106-116)
  • security/pkg/server/ca/authenticate/oidc.go (101-105)
  • security/pkg/k8s/chiron/utils.go (157-160)
  • security/pkg/pki/ra/common.go (195-207)
  • pkg/wasm/imagefetcher.go (183-186)
  • pilot/pkg/xds/debug.go (1009-1011)
  • pilot/pkg/features/pilot.go (332-336)
  • go.mod (79)

✨ Enhanced Traffic Management & Gateway API Stability

This release brings several key enhancements and bug fixes to Istio’s traffic management capabilities, particularly focusing on the Gateway API and its integration with advanced features like InferencePools. These changes improve routing accuracy, prevent configuration conflicts, and ensure your Gateway configurations behave as expected, even in complex deployment scenarios.

Key improvements include:

  • InferencePool BackendRef Fixes: Addressed issues where an HTTPRoute rule with multiple InferencePool backendRefs only configured one endpoint picker, or where two HTTPRoutes with shared rule names would overwrite each other’s pickers. Now, each InferencePool backendRef gets its own dedicated endpoint picker, ensuring correct traffic weighting and pool-specific scoring. Additionally, a bug that caused route rules with CORS filters to lose their InferencePool endpoint picker has been resolved, allowing both features to coexist seamlessly.
  • ServiceEntry Broad Address Validation: Istio now issues a validation warning for ServiceEntry addresses that are catch-all (0.0.0.0, ::), have an unspecified network (0.0.0.0/N, ::/N), or are CIDRs with a prefix shorter than /8. This helps prevent unintended traffic bypasses of outboundTrafficPolicy: REGISTRY_ONLY when using resolution: NONE.
  • Overlapping Gateway ListenerSet Ports: Fixed a bug that prevented the creation of internal listeners when a Gateway API ListenerSet or Gateway listener was configured with HTTPS or TLS but lacked a TLS section, leading to resource misconfiguration.
  • Ambient Workload Address Stability: Corrected an issue where pre-marshaled workload data for change detection in ambient mode was unstable when a workload had multiple services. This fix ensures that unchanged workloads are correctly identified, preventing unnecessary recomputes and improving client connection stability.
  • Incremental CDS Push Optimization: Improved incremental CDS pushes to correctly handle endpoint updates without triggering full EDS generation for unrelated configuration changes, leading to more efficient resource updates.
  • EnvoyFilter Referenced Services in Delta CDS: Fixed a bug where incremental CDS pushes removed gateway clusters for Services listed in the envoyfilter.istio.io/referenced-services annotation of an EnvoyFilter, with these clusters only being restored on a full push. This ensures that services explicitly referenced by EnvoyFilters remain available during incremental updates.

Source:

  • pilot/pkg/config/kube/gateway/conversion.go (985-1008)
  • pilot/pkg/config/kube/gateway/route_collections.go (175-188)
  • pilot/pkg/networking/core/route/route.go (673-697)
  • pkg/config/validation/validation.go (2960-2967)
  • pilot/pkg/config/kube/gateway/gateway_collection.go (341-344)
  • pilot/pkg/model/service.go (1151-1157)
  • pilot/pkg/xds/eds.go (163-167)
  • pilot/pkg/networking/core/cluster.go (129-138)

🚀 Improved System Robustness & Observability

This release significantly bolsters the resilience and operational visibility of your Istio deployments. Critical updates ensure that Kubernetes API interactions are more robust, preventing indefinite hangs and providing clearer insights into potential issues. These changes translate to a more stable control plane and improved reliability across your clusters.

Key improvements include:

  • Kubernetes API Client-Side Deadlines: Istio components now enforce client-side timeouts on Kubernetes API requests, preventing indefinite hangs if the API server fails to respond (e.g., due to a silent load balancer drop). Requests now time out after a default of 15 minutes total and 90 seconds for headers, logging warnings and incrementing kube_client_deadline_fired_total metrics. This improves controller recovery and stability.
  • Multi-Cluster Kclient Handler Shutdown: Fixed a bug where removing a single event handler from a CRD-backed informer would inadvertently remove all handlers, leading to issues in ambient multi-cluster mode with credential rotations and potential workload index staleness.
  • Leader Election Context Timeout: The Kubernetes leader election acquisition process now bounds hung client requests with a timeout equal to the RenewDeadline. This ensures that a hung acquire attempt is abandoned and retried, preventing permanent election stalls.
  • Pilot Agent HTTP/2 Probing: The pilot-agent now correctly configures HTTP/2 transports for health probes, ensuring proper ALPN negotiation and robust health checking for application endpoints.

Source:

  • pkg/kube/deadline.go (1-145)
  • pkg/kube/transport.go (1-61)
  • pkg/kube/util.go (197-200)
  • pkg/kube/kclient/delayed.go (178-185)
  • pilot/pkg/leaderelection/k8sleaderelection/leaderelection.go (268-271)
  • pilot/cmd/pilot-agent/status/server.go (1066-1087)

⚙️ Installation & Development Experience Improvements

This release refines the installation process and developer experience with targeted fixes and dependency updates. OpenShift users will benefit from more precise proxy UID/GID assignments, and internal tooling has been made more resilient, ensuring a smoother journey from development to deployment.

Key updates include:

  • OpenShift Proxy UID/GID Resolution: Improved sidecar proxy UID/GID resolution on OpenShift, especially for workloads bound to custom SecurityContextConstraint resources with narrow or explicitly configured UID ranges. This ensures that proxies are assigned legal and distinct UIDs/GIDs, preventing conflicts with application containers.
  • Helm Chart Registry Update: Updated the default Helm chart repository from istio-release.storage.googleapis.com to blob.istio.io/istio-release/charts. This change reflects an upcoming deprecation, ensuring continued access to Istio releases.
  • Go 1.26.0 Upgrade: The project has been upgraded to Go 1.26.0, bringing performance improvements and the latest language features.
  • Dependency Bumps: Numerous Go module dependencies have been updated across cloud.google.com/go, github.com/docker/cli, prometheus, go.opentelemetry.io/otel, go.uber.org/atomic, golang.org/x/*, and google.golang.org/* to incorporate the latest fixes and features.

Source:

Minor Updates & Housekeeping

This release also includes general housekeeping, such as updates to the BASE_VERSION, devcontainer.json image references, and various ztunnel and proxy component updates to ensure consistency and leverage the latest upstream fixes.