CVE-2022-23635
Unauthenticated control plane denial of service attack in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unauthenticated control plane denial of service attack in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
- Record
CVE-2022-23635- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2022-0904
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
- Record
EUVD-2022-0904- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-856q-xv3c-7f2f
Unauthenticated control plane denial of service attack in Istio
Impact
The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker.
For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet.
Patches
- Istio 1.13.1 and above
- Istio 1.12.4 and above
- Istio 1.11.7 and above
Workarounds
There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
References
More details can be found in the Istio Security Bulletin
For more information
If you have any questions or comments about this advisory, please email us at [email protected]
- Record
GHSA-856q-xv3c-7f2f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-287, CWE-1284
- Updated
- 2026-11-02
NVD
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
- Record
CVE-2022-23635- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-287, CWE-1284
- Updated
- 2026-11-02
OSV
Unauthenticated control plane denial of service attack in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
- Record
CVE-2022-23635- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-856q-xv3c-7f2f
Unauthenticated control plane denial of service attack in Istio
Impact
The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker.
For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet.
Patches
- Istio 1.13.1 and above
- Istio 1.12.4 and above
- Istio 1.11.7 and above
Workarounds
There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
References
More details can be found in the Istio Security Bulletin
For more information
If you have any questions or comments about this advisory, please email us at [email protected]
- Record
GHSA-856q-xv3c-7f2f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1284, CWE-287
- Updated
- 2026-11-02
OSVRHSA-2022:1275
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2 security update
- Record
RHSA-2022:1275- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2022:1276
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update
- Record
RHSA-2022:1276- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
istio.io/istioGo |
1.13.0 to 1.13.0 | 1.13.1 |
istio.io/istioGo |
1.12.0 up to 1.12.4 | 1.12.4 |
istio.io/istioGo |
before 1.11.7 | 1.11.7 |
istio.io/istioGo |
1.13.0 up to 1.13.1 | 1.13.1 |
servicemesh-proxyRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemesh-proxy-debuginfoRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemesh-proxy-debugsourceRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemesh-proxy-wasmRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemeshRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemesh-cniRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
servicemesh-pilot-agentRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemesh-pilot-discoveryRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
servicemeshRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
servicemesh-istioctlRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
servicemesh-mixcRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
servicemesh-mixsRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
servicemesh-pilot-agentRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
servicemesh-pilot-discoveryRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
kialiRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:v1.24.7.redhat1-1.el8 | 0:v1.24.7.redhat1-1.el8 |
servicemesh-prometheusRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.14.0-16.el8.1 | 0:2.14.0-16.el8.1 |
servicemesh-proxyRed Hat:service_mesh:2.0::el8 From an advisory covering 16 CVEs |
before 0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23635 is a high vulnerability (CVSS 7.5) in Istio, published February 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in istio.io/istio 1.13.1.
References
github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f
istio.io/latest/news/security/istio-security-2022-003
nvd.nist.gov/vuln/detail/CVE-2022-23635
Show 83 moreShow less
access.redhat.com/errata/RHSA-2022:1275
bugzilla.redhat.com/show_bug.cgi?id=2050744
issues.redhat.com/browse/OSSM-1074
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1275.json
cve.org/CVERecord?id=CVE-2021-43824
huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
sick.codes/sick-2021-016
groups.google.com/g/golang-announce/c/uHACNfXAZqk