CVE-2022-39388

Istio may allow identity impersonation if user has localhost access

7.6 HighFix available

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.53%Down 0.4 points since Nov 11, 2022

What each source reports

CVE List Score used 7.6

Istio may allow identity impersonation if user has localhost access

Record: CVE-2022-39388
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2022-7256 7.6

Record: EUVD-2022-7256
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6c6p-h79f-g6p4 7.6

Istio may allow identity impersonation if user has localhost access

Impact

User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.

Patches

1.15.3

Workarounds

No. If using 1.15.2 please upgrade to 1.15.3 or later.

References

None at this time.

For more information

If you have any questions or comments about this advisory, please email us at [email protected]

Record: GHSA-6c6p-h79f-g6p4
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 7.6

Record: CVE-2022-39388
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 3.1: 3.5 LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 7.6

Istio may allow identity impersonation if user has localhost access

Record: CVE-2022-39388
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVGHSA-6c6p-h79f-g6p4 7.6

Istio may allow identity impersonation if user has localhost access

Impact

User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.

Patches

1.15.3

Workarounds

No. If using 1.15.2 please upgrade to 1.15.3 or later.

References

None at this time.

For more information

If you have any questions or comments about this advisory, please email us at [email protected]

Record: GHSA-6c6p-h79f-g6p4
CVSS 3.1: 7.6 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

istio

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/istio/istio` Go	1.15.0-beta.0 up to 1.15.3	1.15.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39388 is a high vulnerability (CVSS 7.6) in Istio, published November 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in github.com/istio/istio 1.15.3.