Every CVE Search/ Get API key

CVE-2021-31921

Istio before 1.8.6 and 1.9.x before 1.9.5, when a gateway is using the AUTO_PASSTHROUGH routing...

9.8 CriticalFix available

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.45%Up 1.0 points since Jun 3, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

Record
CVE-2021-31921
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-862
Updated
2026-11-02
CVE List No score

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

Record
CVE-2021-31921
Updated
2026-11-02
EUVDEUVD-2021-18794 No score

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

Record
EUVD-2021-18794
Updated
2026-11-03
GitHub AdvisoriesGHSA-3j84-jghj-gqwg 9.8

Istio before 1.8.6 and 1.9.x before 1.9.5, when a gateway is using the AUTO_PASSTHROUGH routing...

Istio before 1.8.6 and 1.9.x before 1.9.5, when a gateway is using the AUTO_PASSTHROUGH routing configuration, allows attackers to bypass authorization checks and access unexpected services in the cluster.

Record
GHSA-3j84-jghj-gqwg
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
OSV 9.8

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

Record
CVE-2021-31921
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:2061 10.0

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.5 security update

Record
RHSA-2021:2061
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:2085 10.0

Red Hat Security Advisory: servicemesh security update

Record
RHSA-2021:2085
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
servicemesh
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh-istioctl
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh-mixc
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh-mixs
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh-pilot-agent
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:2.0::el8
 before 0:2.0.5-3.el8
0:2.0.5-3.el8
servicemesh
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-citadel
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-galley
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-istioctl
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
Show 5 moreShow less
Affected packages
PackageAffectedFixed
servicemesh-mixc
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-mixs
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-pilot-agent
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-pilot-discovery
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8
servicemesh-sidecar-injector
Red Hat:service_mesh:1.1::el8
 before 0:1.1.15-4.el8
0:1.1.15-4.el8

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-31921 is a critical vulnerability (CVSS 9.8) in Istio, published June 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in servicemesh 0:2.0.5-3.el8.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open