Description
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| istio | istio | < 1.9.8, >= 1.10.0, < 1.10.4, >= 1.11.0, < 1.11.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | servicemesh +6 | 2.0.7-3.el8 | RHSA-2021:3272 |
| Red Hat Service Mesh 1 | servicemesh +8 | 1.1.17-3.el8 | RHSA-2021:3273 |
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.1.17-2.el8 | RHSA-2021:3273 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
mostafaanouarghorab/MicroserviceCVE-2021-39156 ★ 0 · Mar 26, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | istio.io/istio | < 1.9.8 | 1.9.8 | GHSA-hqxw-mm44-gc4r |
| Go | istio.io/istio | >= 1.10.0, < 1.10.4 | 1.10.4 | GHSA-hqxw-mm44-gc4r |
| Go | istio.io/istio | >= 1.11.0, < 1.11.1 | 1.11.1 | GHSA-hqxw-mm44-gc4r |
Advisories 2
- RHSA-2021:3273 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.17.1 security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2021:3272 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.7.1 security update Red Hat Security Advisories (RHSA) · Mar 18, 2026