Announcing Istio 1.30.7

Istio 1.30.7 patch release.

Oct 21, 2026

This release contains security fixes. This release note describes what’s different between Istio 1.30.6 and 1.30.7.

Things to know and prepare before upgrading.

Download and install this release.

Visit the documentation for this release.

Inspect the full set of source code changes.

Security update

For more information, see ISTIO-SECURITY-2026-008.

Removed trust in the compromised eMudhra intermediate CA certificates. The CA bundle in the ubuntu-based and distroless images no longer includes emSign ECC Root CA - G3.
CVE-2026-111943: Updated Go to 1.26.10, which rejects certificate chains that contain any of the compromised eMudhra intermediate keys in istiod, istioctl, and pilot-agent.
Updated rustls-webpki in ztunnel to 0.103.16, which rejects certificate chains that contain any of the compromised eMudhra intermediate keys.

Fixed the ambient node-untaint controller removing the cni.istio.io/not-ready taint when only istio-cni was ready. It can now also wait for ztunnel to be ready on the node, so pods are not scheduled onto a node whose ztunnel is still wedged. This is off by default on this release branch and is enabled with PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true. Only applies when ambient is enabled. (Issue #52073)
Fixed istiod failing to start when the self-signed CA certificate in istio-ca-secret has expired, which can happen when the deployment is scaled to zero for longer than the certificate TTL. The expired certificate is now automatically renewed using the existing private key.
Fixed istioctl bug-report --duration not filtering logs when used without --end-time.