Skip to content
OpenAdvisories

Package · Go

istio.io/istio

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-41413

    Istio Vulnerable to SSRF via RequestAuthentication jwksUri

    Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to t…

    istio istio cert-manager-istio-csr istio.io/istio Wolfi Go
  • Medium 5.4
    CVE-2026-39350

    Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

    Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a …

    istio istio cert-manager-istio-csr istio.io/istio Wolfi Go
  • Medium 6.8
    CVE-2020-16844

    Authorization bypass in Istio

    In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypass…

    istio.io/istio Go