{"id":"CVE-2022-39388","aliases":["EUVD-2022-7256","GHSA-6c6p-h79f-g6p4"],"status":"published","title":"Istio may allow identity impersonation if user has localhost access","description":"Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00531,"percentile":0.45211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-11-09T22:07:01Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Go","package":"github.com/istio/istio","fixed_in":["1.15.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/istio/istio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0-beta.0"},{"fixed":"1.15.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/istio/istio","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0-beta.0"},{"fixed":"1.15.3"}]}]}],"products":[{"vendor":"istio","product":"istio"}],"references":[{"url":"https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3/","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39388","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6c6p-h79f-g6p4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39388.json","tags":["advisory"]},{"url":"https://github.com/istio/istio","tags":["package"]},{"url":"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-39388","title":"Istio may allow identity impersonation if user has localhost access","description":"Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-04-23T16:39:23.029Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-7256","description":"Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-04-23T16:39:23Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:12.313971Z"}],"ghsa":[{"id":"GHSA-6c6p-h79f-g6p4","title":"Istio may allow identity impersonation if user has localhost access","description":"### Impact\n\nUser can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.\n\n### Patches\n1.15.3\n\n### Workarounds\nNo. If using 1.15.2 please upgrade to 1.15.3 or later.\n\n### References\nNone at this time.\n\n### For more information\nIf you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)\n","status":"published","published":"2022-11-09T22:07:01Z","modified":"2023-01-28T05:03:10Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:36:24.277749Z"}],"nvd":[{"id":"CVE-2022-39388","description":"Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.","status":"published","published":"2022-11-10T20:15:10.587Z","modified":"2026-06-17T04:58:15.97Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-39388","title":"Istio may allow identity impersonation if user has localhost access","description":"Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2026-10-28T02:30:36.553350331Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-6c6p-h79f-g6p4","title":"Istio may allow identity impersonation if user has localhost access","description":"### Impact\n\nUser can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.\n\n### Patches\n1.15.3\n\n### Workarounds\nNo. If using 1.15.2 please upgrade to 1.15.3 or later.\n\n### References\nNone at this time.\n\n### For more information\nIf you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)\n","status":"published","published":"2022-11-09T22:07:01Z","modified":"2023-11-08T04:10:20.714703Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}