CVE-2020-16844
Authorization bypass in Istio
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
- Record
CVE-2020-16844- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
- Record
CVE-2020-16844- Updated
- 2026-11-02
EUVDEUVD-2022-0899 No score
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
- Record
EUVD-2022-0899- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-82mm-ffjr-h86c
Authorization bypass in Istio
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
Specific Go Packages Affected
istio.io/istio/pilot/pkg/security/authz/model/matcher
- Record
GHSA-82mm-ffjr-h86c- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
- Record
CVE-2020-16844- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-82mm-ffjr-h86c
Authorization bypass in Istio
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
Specific Go Packages Affected
istio.io/istio/pilot/pkg/security/authz/model/matcher
- Record
GHSA-82mm-ffjr-h86c- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVRHSA-2020:3425
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 security update
- Record
RHSA-2020:3425- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
istio.io/istioGo |
1.5.0 up to 1.5.9 | 1.5.9 |
istio.io/istioGo |
1.6.0 up to 1.6.8 | 1.6.8 |
servicemeshRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-citadelRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-galleyRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-istioctlRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-mixcRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-mixsRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-pilot-agentRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-pilot-discoveryRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
servicemesh-sidecar-injectorRed Hat:service_mesh:1.1::el8 |
before 0:1.1.7-1.el8 | 0:1.1.7-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-16844 is a medium vulnerability (CVSS 6.8) in Istio, published October 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in istio.io/istio 1.5.9.
References
github.com/istio/istio/releases
istio.io/latest/news/security/istio-security-2020-009
nvd.nist.gov/vuln/detail/CVE-2020-16844
Show 10 moreShow less
access.redhat.com/errata/RHSA-2020:3425
bugzilla.redhat.com/show_bug.cgi?id=1861625
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3425.json
cve.org/CVERecord?id=CVE-2020-16844