Feature

The Envoy Compressor Filter is now GA in the regular release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

Security

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

Security

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

Security

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Security

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

Security

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Security

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Security

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

Feature

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

Feature

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Security

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Announcement

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

Announcement

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Security

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

Security

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

Security

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

Announcement

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

Announcement

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Fixed

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs:

Announcement

1.27.9-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.4 uses Envoy v1.35.10-dev.

Fixed

Patch 1.27.9-asm.4 contains fixes for the following platform CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

Fixed

These patch releases contain the fixes for the following CVEs:

Announcement

1.26.8-asm.10 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.10 uses Envoy v1.34.14.

Fixed

Patch 1.26.8-asm.10 contains fixes for the following platform CVEs:

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the stable channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Cloud Service Mesh can now report a status code to indicate whether an Istio API is accepted or rejected. You can view the status code on the resource and mesh state. For more information see MembershipState Error Codes.

Security

Proxy version csm_mesh_proxy.20260423_RC03 is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

Announcement

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

Announcement

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

Announcement

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.19 is rolling out to the rapid release channel.
• 1.20.8-asm.73 is rolling out to the regular release channel.
• 1.19.10-asm.66 is rolling out to the stable release channel.

These patch releases contain the fixes for the following CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.19 is rolling out to the rapid release channel.
• 1.20.8-asm.73 is rolling out to the regular release channel.
• 1.19.10-asm.66 is rolling out to the stable release channel.

These patch releases contain the fixes for the following CVEs:

Announcement

1.26.8-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.5 uses Envoy 1.34.14-dev.

Announcement

1.26.8-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.5 uses Envoy 1.34.14-dev.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Security

1.28.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.9 uses Envoy 1.36.5.

Security

1.28.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.9 uses Envoy 1.36.5.

Security

1.27.8-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.7 uses Envoy 1.35.9.

Security

1.27.8-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.7 uses Envoy 1.35.9.

Security

1.26.8-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.3 uses Envoy 1.34.13.

Security

1.26.8-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.3 uses Envoy 1.34.13.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.16 is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.68 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.61 is rolling out to the stable release channel.
• CNI and managed data plane controller version 1.23.6-asm.31 is rolling out to all release channels.

These rollouts will preempt those previously announced on February 9, 2026.

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260304_RC00 for Gateway API on GKE clusters for all channels. This proxy version maps closest to Envoy version 1.37.

These patch releases contain the fixes for the vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.16 is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.68 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.61 is rolling out to the stable release channel.
• CNI and managed data plane controller version 1.23.6-asm.31 is rolling out to all release channels.

These rollouts will preempt those previously announced on February 9, 2026.

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260304_RC00 for Gateway API on GKE clusters for all channels. This proxy version maps closest to Envoy version 1.37.

These patch releases contain the fixes for the vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

Announcement

CNI and managed data plane controller version 1.23.6-asm.28 is rolling out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

This patch includes the fix for the following CVEs:

Announcement

CNI and managed data plane controller version 1.23.6-asm.28 is rolling out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

This patch includes the fix for the following CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.10 is rolling out to the rapid release channel.
• 1.20.8-asm.63 is rolling out to the regular release channel.
• 1.19.10-asm.57 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.10 is rolling out to the rapid release channel.
• 1.20.8-asm.63 is rolling out to the regular release channel.
• 1.19.10-asm.57 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

Announcement

1.28.2-asm.4 is now available for in-cluster Cloud Service Mesh.

You can now download 1.28.2-asm.4 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.28.0 subject to the list of supported features.

The following environment variables, fields, and annotations are not supported:

• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• Additional attributes for HTTPCookie in the DestinationRule API
• caCertCredentialName field in ServerTLSSettings API
• Optional NetworkPolicy for Istiod deployment
• Disable shadow host suffix
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP

Istio dual stack is not supported

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The ENABLE_AUTO_SNI flag is still supported to stay aligned with legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.28.2-asm.4 uses Envoy v1.36.5-dev.

Announcement

1.28.2-asm.4 is now available for in-cluster Cloud Service Mesh.

You can now download 1.28.2-asm.4 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.28.0 subject to the list of supported features.

The following environment variables, fields, and annotations are not supported:

• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• Additional attributes for HTTPCookie in the DestinationRule API
• caCertCredentialName field in ServerTLSSettings API
• Optional NetworkPolicy for Istiod deployment
• Disable shadow host suffix
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP

Istio dual stack is not supported

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The ENABLE_AUTO_SNI flag is still supported to stay aligned with legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.28.2-asm.4 uses Envoy v1.36.5-dev.

Announcement

1.27.5-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.5-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.5 subject to the list of supported features. Cloud Service Mesh version 1.27.5-asm.0 uses envoy v1.35.9-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Announcement

1.27.5-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.5-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.5 subject to the list of supported features. Cloud Service Mesh version 1.27.5-asm.0 uses envoy v1.35.9-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Announcement

1.26.8-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.8-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.8 subject to the list of supported features. Cloud Service Mesh version 1.26.8-asm.1 uses envoy v1.34.11.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Announcement

1.26.8-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.8-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.8 subject to the list of supported features. Cloud Service Mesh version 1.26.8-asm.1 uses envoy v1.34.11.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Announcement

In-cluster Cloud Service Mesh 1.25 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Announcement

In-cluster Cloud Service Mesh 1.25 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.8 is rolling out to the rapid release channel.
• 1.20.8-asm.60 is rolling out to the regular release channel.
• 1.19.10-asm.55 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.8 is rolling out to the rapid release channel.
• 1.20.8-asm.60 is rolling out to the regular release channel.
• 1.19.10-asm.55 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

Announcement

Regional Cloud Service Mesh is now available as a public preview feature. See Regional Cloud Service Mesh for more information.

Announcement

Regional Cloud Service Mesh is now available as a public preview feature. See Regional Cloud Service Mesh for more information.

Announcement

Regional Cloud Service Mesh is now available as a public preview feature. See Regional Cloud Service Mesh for more information.

Announcement

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20251121c_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

Announcement

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20251121c_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerability listed in [GCP-2025-073](/service-mesh/v1.27/docs/security-bulletins#gcp-2025-073.

Announcement

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20251121c_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.7 is rolling out to the rapid release channel.
• 1.20.8-asm.59 is rolling out to the regular release channel.
• 1.19.10-asm.54 is rolling out to the stable release channel.

These patch releases contain the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.7 is rolling out to the rapid release channel.
• 1.20.8-asm.59 is rolling out to the regular release channel.
• 1.19.10-asm.54 is rolling out to the stable release channel.

These patch releases contain the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.7 is rolling out to the rapid release channel.
• 1.20.8-asm.59 is rolling out to the regular release channel.
• 1.19.10-asm.54 is rolling out to the stable release channel.

These patch releases contain the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

Security

1.25.6-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.6-asm.1 uses Envoy v1.33.13.

Security

1.25.6-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.6-asm.1 uses Envoy v1.33.13.

Security

1.25.6-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.6-asm.1 uses Envoy v1.33.13.

Security

1.27.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.4-asm.1 uses Envoy v1.35.7.

Security

1.27.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.4-asm.1 uses Envoy v1.35.7.

Security

1.27.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.4-asm.1 uses Envoy v1.35.7.

Security

1.26.7-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.7-asm.1 uses Envoy v1.34.11.

Security

1.26.7-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.7-asm.1 uses Envoy v1.34.11.

Security

1.26.7-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.7-asm.1 uses Envoy v1.34.11.

Announcement

The following rollouts have completed for managed Cloud Service Mesh:

• 1.21.6-asm.4 has rolled out to the rapid release channel.
• 1.20.8-asm.56 has rolled out to the regular release channel.
• 1.19.10-asm.52 has rolled out to the stable release channel.
• CNI and MDPC version 1.20.8-asm.56 has rolled out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

Announcement

The following rollouts have completed for managed Cloud Service Mesh:

• 1.21.6-asm.4 has rolled out to the rapid release channel.
• 1.20.8-asm.56 has rolled out to the regular release channel.
• 1.19.10-asm.52 has rolled out to the stable release channel.
• CNI and MDPC version 1.20.8-asm.56 has rolled out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

Announcement

The following rollouts have completed for managed Cloud Service Mesh:

• 1.21.6-asm.4 has rolled out to the rapid release channel.
• 1.20.8-asm.56 has rolled out to the regular release channel.
• 1.19.10-asm.52 has rolled out to the stable release channel.
• CNI and MDPC version 1.20.8-asm.56 has rolled out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

Security

1.25.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.5-asm.9 uses Envoy v1.33.12.

Security

1.25.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.5-asm.9 uses Envoy v1.33.12.

Security

1.25.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.5-asm.9 uses Envoy v1.33.12.

Security

1.27.2-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.2-asm.1 uses Envoy v1.35.6.

Security

1.27.2-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.2-asm.1 uses Envoy v1.35.6.

Security

1.27.2-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.2-asm.1 uses Envoy v1.35.6.

Security

1.26.5-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.5-asm.1 uses Envoy v1.34.10.

Security

1.26.5-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.5-asm.1 uses Envoy v1.34.10.

Security

1.26.5-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.5-asm.1 uses Envoy v1.34.10.

Fixed

These patches contain fixes for the following CVEs:

1.21.6-asm.4

1.20.8-asm.55

1.19.10-asm.52

CNI & MDPC

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.4 is rolling out to the rapid release channel.
• 1.20.8-asm.56 is rolling out to the regular release channel.
• 1.19.10-asm.52 is rolling out to the stable release channel.

CNI/managed data plane controller version 1.20.8-asm.56 is rolling out to all release channels.

Fixed

These patches contain fixes for the following CVEs:

1.21.6-asm.4

1.20.8-asm.55

1.19.10-asm.52

CNI & MDPC

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.4 is rolling out to the rapid release channel.
• 1.20.8-asm.56 is rolling out to the regular release channel.
• 1.19.10-asm.52 is rolling out to the stable release channel.

CNI/managed data plane controller version 1.20.8-asm.56 is rolling out to all release channels.

Fixed

These patches contain fixes for the following CVEs:

1.21.6-asm.4

1.20.8-asm.55

1.19.10-asm.52

CNI & MDPC

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.4 is rolling out to the rapid release channel.
• 1.20.8-asm.56 is rolling out to the regular release channel.
• 1.19.10-asm.52 is rolling out to the stable release channel.

CNI/managed data plane controller version 1.20.8-asm.56 is rolling out to all release channels.

Announcement

The promotion of 1.21 to the Rapid release channel included upstream breaking changes to ExternalName and auto-sni when using the ISTIOD implementation. After considering the impact on customers, we have decided to restore the previous behavior from 1.20 and earlier for managed Cloud Service Mesh clusters using the ISTIOD implementation to match Rapid clusters using the TRAFFIC_DIRECTOR implementation. These changes are rolling out to the Rapid release channel in version 1.21.5-asm.55 or later.

• If you are using an ExternalName service in the Rapid channel without a port description, the ExternalName service will not be translated into Cluster in the Envoy configuration. If the ExternalName service is a destination of VirtualService or ExternalName service is used with REGISTRY_ONLY mode, you must specify the port in the service like in 1.20 and earlier.

• If you have an external service multiplexing traffic based on SNI but the corresponding DestinationRule doesn't have an explicit SNI, you must set SNI properly.

Announcement

The promotion of 1.21 to the Rapid release channel included upstream breaking changes to ExternalName and auto-sni when using the ISTIOD implementation. After considering the impact on customers, we have decided to restore the previous behavior from 1.20 and earlier for managed Cloud Service Mesh clusters using the ISTIOD implementation to match Rapid clusters using the TRAFFIC_DIRECTOR implementation. These changes are rolling out to the Rapid release channel in version 1.21.5-asm.55 or later.

• If you are using an ExternalName service in the Rapid channel without a port description, the ExternalName service will not be translated into Cluster in the Envoy configuration. If the ExternalName service is a destination of VirtualService or ExternalName service is used with REGISTRY_ONLY mode, you must specify the port in the service like in 1.20 and earlier.

• If you have an external service multiplexing traffic based on SNI but the corresponding DestinationRule doesn't have an explicit SNI, you must set SNI properly.

Announcement

The promotion of 1.21 to the Rapid release channel included upstream breaking changes to ExternalName and auto-sni when using the ISTIOD implementation. After considering the impact on customers, we have decided to restore the previous behavior from 1.20 and earlier for managed Cloud Service Mesh clusters using the ISTIOD implementation to match Rapid clusters using the TRAFFIC_DIRECTOR implementation. These changes are rolling out to the Rapid release channel in version 1.21.5-asm.55 or later.

• If you are using an ExternalName service in the Rapid channel without a port description, the ExternalName service will not be translated into Cluster in the Envoy configuration. If the ExternalName service is a destination of VirtualService or ExternalName service is used with REGISTRY_ONLY mode, you must specify the port in the service like in 1.20 and earlier.

• If you have an external service multiplexing traffic based on SNI but the corresponding DestinationRule doesn't have an explicit SNI, you must set SNI properly.

Announcement

1.25.5-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.5-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.5 subject to the list of supported features. Cloud Service Mesh version 1.25.5-asm.7 uses envoy v1.33.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Fixed

1.25.5-asm.7 includes the fixes for the following CVEs:

Announcement

1.25.5-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.5-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.5 subject to the list of supported features. Cloud Service Mesh version 1.25.5-asm.7 uses envoy v1.33.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Fixed

1.25.5-asm.7 includes the fixes for the following CVEs:

Announcement

1.25.5-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.5-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.5 subject to the list of supported features. Cloud Service Mesh version 1.25.5-asm.7 uses envoy v1.33.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Fixed

1.25.5-asm.7 includes the fixes for the following CVEs:

Fixed

1.26.4-asm.7 includes the fixes for the following CVEs:

Announcement

1.26.4-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.4-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.4 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.26.4-asm.7 uses Envoy v1.34.8-dev.

Announcement

1.26.4-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.4-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.4 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.26.4-asm.7 uses Envoy v1.34.8-dev.

Fixed

1.26.4-asm.7 includes the fixes for the following CVEs:

Fixed

1.26.4-asm.7 includes the fixes for the following CVEs:

Announcement

1.26.4-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.4-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.4 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.26.4-asm.7 uses Envoy v1.34.8-dev.

Fixed

1.27.1-asm.5 includes the fixes for the following CVEs:

Announcement

1.27.1-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.1-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.1 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.27.1-asm.5 uses Envoy v1.35.4-dev.

Fixed

1.27.1-asm.5 includes the fixes for the following CVEs:

Announcement

1.27.1-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.1-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.1 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.27.1-asm.5 uses Envoy v1.35.4-dev.

Announcement

1.27.1-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.1-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.1 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.27.1-asm.5 uses Envoy v1.35.4-dev.

Fixed

1.27.1-asm.5 includes the fixes for the following CVEs:

Announcement

In-cluster Cloud Service Mesh 1.24 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Announcement

In-cluster Cloud Service Mesh 1.24 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Announcement

In-cluster Cloud Service Mesh 1.24 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Feature

You can now configure traffic routing using Cloud Service Mesh service routing APIs between Cloud Run and Cloud Run, Google Kubernetes Engine, and Google Compute Engine services. (GA).

Change

Managed Cloud Service Mesh with a TD control plane in the Rapid release channel will start using proxy images with an internal envoy version.

All features supported by Managed (TD) control planes are supported by this proxy. To identify which proxy version is used in a cluster, see Identify the proxy versions used in the cluster.

This release uses the version csm_istio_proxy_20250611.00_p0. More details about the proxy version can be found on the Versions page.

Feature

You can now configure traffic routing using Cloud Service Mesh service routing APIs between Cloud Run and Cloud Run, Google Kubernetes Engine, and Google Compute Engine services. (GA).

Change

Managed Cloud Service Mesh with a TD control plane in the Rapid release channel will start using proxy images with an internal envoy version.

All features supported by Managed (TD) control planes are supported by this proxy. To identify which proxy version is used in a cluster, see Identify the proxy versions used in the cluster.

This release uses the version csm_istio_proxy_20250611.00_p0. More details about the proxy version can be found on the Versions page.

Change

Managed Cloud Service Mesh with a TD control plane in the Rapid release channel will start using proxy images with an internal envoy version.

All features supported by Managed (TD) control planes are supported by this proxy. To identify which proxy version is used in a cluster, see Identify the proxy versions used in the cluster.

This release uses the version csm_istio_proxy_20250611.00_p0. More details about the proxy version can be found on the Versions page.

Feature

You can now configure traffic routing using Cloud Service Mesh service routing APIs between Cloud Run and Cloud Run, Google Kubernetes Engine, and Google Compute Engine services. (GA).

Announcement

CNI/managed data plane controller version 1.23.6-asm.15 is rolling out to all release channels.

Fixed

Announcement

CNI/managed data plane controller version 1.23.6-asm.15 is rolling out to all release channels.

Fixed

Announcement

CNI/managed data plane controller version 1.23.6-asm.15 is rolling out to all release channels.

Fixed

Deprecated

Support for the following features will end on March 17, 2027:

• GKE on AWS
• GKE on Azure
• EKS Attached Clusters on AWS
• Azure Attached Clusters with AKS

Note that there are no changes to the other features of GKE attached clusters or Google Distributed Cloud (software only or air-gapped),

You must migrate to an alternative service mesh solution or an alternative Istio-based solution using your existing CSM configuration files by March 17, 2027.

Deprecated

Support for the following features will end on March 17, 2027:

• GKE on AWS
• GKE on Azure
• EKS Attached Clusters on AWS
• Azure Attached Clusters with AKS

Note that there are no changes to the other features of GKE attached clusters or Google Distributed Cloud (software only or air-gapped),

You must migrate to an alternative service mesh solution or an alternative Istio-based solution using your existing CSM configuration files by March 17, 2027.

Deprecated

Support for the following features will end on March 17, 2027:

• GKE on AWS
• GKE on Azure
• EKS Attached Clusters on AWS
• Azure Attached Clusters with AKS

Note that there are no changes to the other features of GKE attached clusters or Google Distributed Cloud (software only or air-gapped),

You must migrate to an alternative service mesh solution or an alternative Istio-based solution using your existing CSM configuration files by March 17, 2027.