CVE-2020-1762: Insufficient Session Expiration in Kiali (CVSS 7.0)

CVE List Score used 7.0

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: CVE-2020-1762
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-613, CWE-384
Updated: 2026-11-02

EUVDEUVD-2021-0930 7.0

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: EUVD-2021-0930
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-465w-gg5p-85c9 8.6

Insufficient Session Expiration in Kiali

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: GHSA-465w-gg5p-85c9
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-295, CWE-384, CWE-613
Updated: 2026-11-02

NVD 7.0

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: CVE-2020-1762
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-384, CWE-613
Updated: 2026-11-02

OSV 8.6

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: CVE-2020-1762
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVGHSA-465w-gg5p-85c9 8.6

Insufficient Session Expiration in Kiali

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Record: GHSA-465w-gg5p-85c9
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness: CWE-295, CWE-384, CWE-613
Updated: 2026-11-02

OSVRHSA-2020:0972 7.0

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.10 Jaeger and Kiali security update

Record: RHSA-2020:0972
CVSS 3.1: 7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVGO-2022-0626 No score

Insufficient Session Expiration in Kiali in github.com/kiali/kiali

Insufficient Session Expiration in Kiali in github.com/kiali/kiali

Record: GO-2022-0626
Updated: 2026-11-02

Package	Affected	Fixed
`github.com/kiali/kiali` Go	0.4.0 up to 1.15.1	1.15.1
`jaeger` Red Hat:service_mesh:1.0::el7	before 0:v1.13.1.redhat6-1.el7	0:v1.13.1.redhat6-1.el7
`kiali` Red Hat:service_mesh:1.0::el7	before 0:v1.0.10.redhat1-1.el7	0:v1.0.10.redhat1-1.el7

When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

CVE-2020-1762

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References