CVE-2020-1764

Hard coded cryptographic key in Kiali

8.6 HighPublic exploitFix available

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: High

Exploit likelihood

3.47%Unchanged since Apr 14, 2021

What each source reports

CVE List Score used 8.6

Record: CVE-2020-1764
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-321
Updated: 2026-11-02

EUVDEUVD-2021-0966 8.6

Record: EUVD-2021-0966
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-64rh-r86q-75ff 8.6

Hard coded cryptographic key in Kiali

Record: GHSA-64rh-r86q-75ff
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-321, CWE-798
Updated: 2026-11-02

NVD 8.6

Record: CVE-2020-1764
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-321, CWE-798
Updated: 2026-11-02

OSV 8.6

Record: CVE-2020-1764
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVGHSA-64rh-r86q-75ff 8.6

Hard coded cryptographic key in Kiali

Record: GHSA-64rh-r86q-75ff
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-321, CWE-798
Updated: 2026-11-02

OSVGO-2022-0631 No score

Hard coded cryptographic key in Kiali in github.com/kiali/kiali

Hard coded cryptographic key in Kiali in github.com/kiali/kiali

Record: GO-2022-0631
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/kiali/kiali` Go	before 1.15.1	1.15.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	jpts/cve-2020-1764-poc	2020-07-06

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-1764 is a high vulnerability (CVSS 8.6) in Kiali, published March 26, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.47%, the 89th percentile. Fixed in github.com/kiali/kiali 1.15.1.

References

Show 4 moreShow less