ReleaseBytes
gcp Google Cloud release notes ·

Cloud Service Mesh Security Patch Releases Address Vulnerability

infragcppreviewengineer
security announcement

Multiple patch versions of Cloud Service Mesh (1.28.7-asm.4, 1.27.9-asm.5, and 1.26.8-asm.11) are now available, each containing a fix for security vulnerability GCP-2026-035. These releases update the underlying Envoy proxy versions and are relevant for users running in-cluster Cloud Service Mesh. A previously announced rollout has been stopped and will be superseded by a new release including these patches.

  • →1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.
  • →1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.
  • →1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.
Security (3) ›
  • Cloud Service Mesh 1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

    1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-035 . For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

    GCP-2026-035Upgrade Cloud Service Mesh
  • Cloud Service Mesh 1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

    1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-035 . For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

    GCP-2026-035Upgrade Cloud Service Mesh
  • Cloud Service Mesh 1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

    1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-035 . For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

    GCP-2026-035Upgrade Cloud Service Mesh
Notes (1) ›
  • Cloud Service Mesh

    The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035 .

    previously announced on June 3, 2026GCP-2026-035
Read the original announcement →

https://docs.cloud.google.com/release-notes#June_08_2026