Skip to content
OpenAdvisories

Package · Go

istio.io/istio

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 5.0
    CVE-2026-41413

    Istio Vulnerable to SSRF via RequestAuthentication jwksUri

    Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to t…

    istio istio cert-manager-istio-csr istio.io/istio Wolfi Go
  • Medium 5.4
    CVE-2026-39350

    Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

    Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a …

    istio istio cert-manager-istio-csr istio.io/istio Wolfi Go
  • High 7.0
    CVE-2022-31045

    Ill-formed headers may lead to unexpected behavior in Istio

    Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at …

    istio istio istio.io/istio Go
  • High 7.5
    CVE-2022-23635

    Unauthenticated control plane denial of service attack in Istio

    Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in …

    istio istio istio.io/istio Go
  • High 8.1
    CVE-2021-39156 Public exploit

    Fragments in Path May Lead to Authorization Policy Bypass

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…

    istio istio istio.io/istio Go
  • High 8.3
    CVE-2021-39155

    Authorization Policy Bypass Due to Case Insensitive Host Comparison

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio aut…

    istio istio istio.io/istio Go
  • Medium 6.8
    CVE-2020-16844

    Authorization bypass in Istio

    In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypass…

    istio.io/istio Go
  • High 7.5
    CVE-2019-18817

    Istio vulnerable to denial of service

    Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836.

    istio.io/istio Go
  • High 7.5
    CVE-2019-14993

    Istio ReDoS Vulnerability

    Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.

    istio.io/istio Go
  • Critical 9.3
    CVE-2019-12243

    Istio may not check inbound TCP connections against istio-policy

    Istio 1.1.x through 1.1.6 has Incorrect Access Control.

    istio.io/istio Go