Announcing Istio 1.24.6

Istio 1.24.6 patch release.

May 13, 2025

This release contains bug fixes to improve robustness. This release note describes what’s different between Istio 1.24.5 and Istio 1.24.6.

Things to know and prepare before upgrading.

Download and install this release.

Visit the documentation for this release.

Inspect the full set of source code changes.

Security Updates

CVE-2025-46821 (CVSS Score 5.3, Medium): Bypass of RBAC uri_template permission.

If you use ** within an AuthorizationPolicy’s path field, it is recommended you upgrade to Istio 1.24.6.

Fixed an issue where validation webhook incorrectly reported a warning when a ServiceEntry configured workloadSelector with DNS resolution. (Issue #50164)
Removed the restriction where revision tag only worked when istiodRemote was not enabled in the istiod helm chart. Revision tags now work as long as the revisionTags is specified without regard to whether istiodRemote is enabled or not. (Issue #54743)