Service mesh

Patch 1.29.8-asm.8 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1) CVE-2026-82474 Yes Yes No Yes Medium (8.5) CVE-2026-82209 Yes Yes No Yes Medium (8.2) CVE-2026-84782 Yes Yes No Yes High (8.2) CVE-2026-96512 Yes Yes No Yes Medium (7.8) CVE-2026-80230 Yes…

Patch 1.30.5-asm.8 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1) CVE-2026-82474 Yes Yes No Yes Medium (8.5) CVE-2026-82209 Yes Yes No Yes Medium (8.2) CVE-2026-84782 Yes Yes No Yes High (8.2) CVE-2026-96512 Yes Yes No Yes Medium (7.8) CVE-2026-80230 Yes…

Patch 1.28.10-asm.49 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1) CVE-2026-82474 Yes Yes No Yes Medium (8.5) CVE-2026-82209 Yes Yes No Yes Medium (8.2) CVE-2026-84782 Yes Yes No Yes High (8.2) CVE-2026-96512 Yes Yes No Yes Medium (7.8) CVE-2026-80230 Yes…

1.28.10-asm.49 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.49 uses Envoy v1.36.10-dev.

1.29.8-asm.8 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.8-asm.8 uses Envoy v1.37.9-dev.

1.31.1-asm.16 is now available for in-cluster Cloud Service Mesh.

You can now download 1.31.1-asm.16 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.31.1 subject to the list of supported features.

1.30.5-asm.8 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.30.5-asm.8 uses Envoy v1.38.7-dev.

Cloud Service Mesh support for the managed ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and…

Cloud Service Mesh support for the managed ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on March 1, 2028.

Cloud Service Mesh support for the in-cluster ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026,…

Cloud Service Mesh support for the in-cluster ISTIOD control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on March 1, 2028.

Patch 1.30.4-asm.14 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2022-31045 Yes Yes Yes Yes Medium (9.8) CVE-2026-5450 No No Yes No Low (9.8) CVE-2026-84304 Yes Yes Yes Yes High (8.7) CVE-2026-84445 Yes Yes Yes Yes High (8.7) CVE-2026-54371 Yes Yes No Yes Medium (8.4) CVE-2019-14993 Yes Yes…

Patch 1.29.7-asm.18 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2022-31045 No Yes Yes Yes Medium (9.8) CVE-2026-11856 No Yes No Yes Medium (9.8) CVE-2026-5450 No No Yes No Low (9.8) CVE-2026-57433 No Yes No Yes Medium (9.8) CVE-2026-12087 No Yes No Yes Medium (9.1) CVE-2026-13221 No Yes No…

1.29.7-asm.18 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.18 uses Envoy v1.37.6.

Patch 1.28.10-asm.40 contains the fix for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity CVE-2022-31045 Yes Yes Yes Yes Medium (9.8) CVE-2026-11856 Yes Yes No Yes Medium (9.8) CVE-2026-5450 No No Yes No Low (9.8) CVE-2026-57433 Yes Yes No Yes Medium (9.8) CVE-2026-12087 Yes Yes No Yes Medium (9.1) CVE-2026-13221 Yes…

1.28.10-asm.40 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.40 uses Envoy v1.36.10-dev.

1.30.4-asm.14 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.30.4-asm.14 uses Envoy v1.38.5-dev.

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters.

This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.

1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features.

In-cluster Cloud Service Mesh 1.27 is no longer supported.

For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The following images are now rolling out for managed Cloud Service Mesh:

1.21.6-asm.71 is rolling out to the rapid release channel.

For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now…

For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now supported in the Rapid release channel. For more information, see Accessing Cloud Trace.