Description
Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | servicemesh +6 | 2.0.4-1.el8 | RHSA-2021:1538 |
| Red Hat Service Mesh 2 | servicemesh-operator | 2.0.4-3.el8 | RHSA-2021:1538 |
| Red Hat Service Mesh 1 | servicemesh +9 | 1.1.14-1.el8 | RHSA-2021:1540 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | istio +3 | 1.9.6-2.el8 | ELSA-2021-9398, ELSA-2021-9396 |
| Oracle Linux 8 | kubeadm +2 | 1.18.18-3.el8 | ELSA-2021-9398, ELSA-2021-9396 |
| Oracle Linux 8 | olcne-olm-chart +1 | 1.3.1-5.el8 | ELSA-2021-9398 |
| Oracle Linux 8 | olcnectl +6 | 1.2.4-5.el8 | ELSA-2021-9398, ELSA-2021-9396 |
| Oracle Linux 7 | istio +1 | 1.9.6-2.el7 | ELSA-2021-9399, ELSA-2021-9397 |
| Oracle Linux 7 | kubeadm +2 | 1.18.18-3.el7 | ELSA-2021-9399, ELSA-2021-9397 |
| Oracle Linux 7 | olcne-olm-chart +1 | 1.3.1-5.el7 | ELSA-2021-9399 |
| Oracle Linux 7 | olcnectl +6 | 1.2.4-5.el7 | ELSA-2021-9399, ELSA-2021-9397 |
Advisories 6
- RHSA-2021:1540 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.14 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2021:1538 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.4 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ELSA-2021-9398 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 6, 2021
- ELSA-2021-9396 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 6, 2021
- ELSA-2021-9399 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 6, 2021
- ELSA-2021-9397 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 6, 2021