{"id":"CVE-2020-16844","aliases":["EUVD-2022-0899","GHSA-82mm-ffjr-h86c","RHSA-2020:3425"],"status":"published","title":"Authorization bypass in Istio","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01095,"percentile":0.65766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2020-10-01T16:32:38Z","modified":"2026-10-20T10:52:00Z","fixes":[{"ecosystem":"Go","package":"istio.io/istio","fixed_in":["1.5.9","1.6.8"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-citadel","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-galley","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-istioctl","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixc","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixs","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-agent","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-discovery","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-sidecar-injector","fixed_in":["0:1.1.7-1.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.8"}]}]},{"source":"osv","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-1.el8"}]}]}],"products":[{"vendor":"istio","product":"istio"}],"references":[{"url":"https://github.com/istio/istio/releases","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://istio.io/latest/news/security/istio-security-2020-009/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Vendor Advisory","evidence","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16844","tags":["advisory"]},{"url":"https://github.com/istio/istio/commit/4c73414556b83f0e75c1b3a0a89a23103a71573c","tags":["web"]},{"url":"https://github.com/istio/istio/commit/72d2e135374f421b656d6f1a21f474db46134ace","tags":["web"]},{"url":"https://github.com/istio/istio/releases/tag/1.5.9","tags":["web"]},{"url":"https://github.com/istio/istio/releases/tag/1.6.8","tags":["web"]},{"url":"https://istio.io/latest/news/releases/1.5.x/announcing-1.5.9/"},{"url":"https://istio.io/latest/news/releases/1.6.x/announcing-1.6.8/"},{"url":"https://github.com/advisories/GHSA-82mm-ffjr-h86c"},{"url":"https://istio.io/latest/news/releases/1.5.x/announcing-1.5.9","tags":["web"]},{"url":"https://istio.io/latest/news/releases/1.6.x/announcing-1.6.8","tags":["web"]},{"url":"https://istio.io/latest/news/security/istio-security-2020-009","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3425","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861625","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3425.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-16844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16844","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-16844","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","status":"published","published":"2020-10-01T16:32:38Z","modified":"2024-08-04T13:45:34.406Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2022-0899","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","status":"published","published":"2020-10-01T16:32:38Z","modified":"2024-08-04T13:45:34Z","updated_at":"2026-11-03T03:07:27.538796Z"}],"ghsa":[{"id":"GHSA-82mm-ffjr-h86c","title":"Authorization bypass in Istio","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.\n\n### Specific Go Packages Affected\nistio.io/istio/pilot/pkg/security/authz/model/matcher","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T13:07:30Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2020-16844","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","status":"published","published":"2020-10-01T17:15:13.15Z","modified":"2026-06-17T02:58:07.657Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-16844","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","status":"published","published":"2020-10-01T17:15:13.15Z","modified":"2026-10-20T10:52:00.058346744Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-82mm-ffjr-h86c","title":"Authorization bypass in Istio","description":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.\n\n### Specific Go Packages Affected\nistio.io/istio/pilot/pkg/security/authz/model/matcher","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-11-08T04:02:39.497559Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"RHSA-2020:3425","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 security update","status":"published","published":"2024-09-16T04:40:35Z","modified":"2026-03-18T11:30:56.288607Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"}]}}