Skip to content
Istio vulnerabilities
Newest
-
andybalholm brotli, 7-zip p7zip, anthropic bun +39 more +41 more
Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-111497
In KEVPublic exploitFix available
EPSS 82.6%
9.2 Critical
-
istio
Istio Vulnerable to SSRF via RequestAuthentication jwksUri
CVE-2026-41413
Fix available
5.0 Medium
-
istio
Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
CVE-2026-39350
Fix available
5.4 Medium
-
istio
Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.
CVE-2026-31838
6.9 Medium
-
istio, red hat cert-manager operator for red hat openshift, externaldns operator +10 more +12 more
Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
CVE-2026-31837
8.7 High
-
eclipse jetty, ietf http, http/2 +166 more +168 more
Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations
CVE-2023-44487
In KEVPublic exploitFix available
EPSS 100.0%
7.5 High
-
istio
Istio may allow identity impersonation if user has localhost access
CVE-2022-39388
Fix available
7.6 High
-
istio
Istio vulnerable to denial of service attack due to Golang Regex Library
CVE-2022-39278
7.5 High
-
istio
Ill-formed headers may lead to unexpected behavior in Istio
CVE-2022-31045
Fix available
7.0 High
-
istio
Unauthenticated control plane denial of service attack in Istio
CVE-2022-24726
7.5 High
-
istio
Unauthenticated control plane denial of service attack in Istio
CVE-2022-23635
Fix available
7.5 High
-
istio
Privileged Escalation in Istio
CVE-2022-21701
5.0 Medium
-
istio
Authorization Policy bypass in Istio
CVE-2022-21679
6.8 Medium
-
istio
Fragments in Path May Lead to Authorization Policy Bypass
CVE-2021-39156
Public exploitFix available
8.1 High
-
istio
Authorization Policy Bypass Due to Case Insensitive Host Comparison
CVE-2021-39155
Fix available
8.3 High
-
istio
Istio before 1.9.6 and 1.10.x before 1.10.2 has Incorrect Access Control.
CVE-2021-34824
Public exploit
8.8 High
-
istio
Istio before 1.8.6 and 1.9.x before 1.9.5, when a gateway is using the AUTO_PASSTHROUGH routing...
CVE-2021-31921
Fix available
9.8 Critical
-
istio
Istio Authorization Bypass Vulnerability
CVE-2021-31920
6.5 Medium
-
istio, redhat openshift service mesh +1 more
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.13 security update
CVE-2019-25014
6.5 Medium
-
istio
Authorization bypass in Istio
CVE-2020-16844
Fix available
6.8 Medium
-
istio, istio.io istio/envoy +1 more
Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when...
CVE-2020-10739
Fix available
7.5 High
-
envoyproxy envoy, istio +1 more
Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection...
CVE-2020-11767
Fix available
3.1 Low
-
istio
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible...
CVE-2020-8843
7.4 High
-
istio, redhat openshift service mesh +1 more
Istio 1.3 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path...
CVE-2020-8595
Fix available
7.3 High
-
istio
Istio vulnerable to denial of service
CVE-2019-18817
Fix available
7.5 High
-
envoyproxy envoy, istio +1 more
Envoy before 1.12.1 allows a remote denial of service because of resource loops, as demonstrated...
CVE-2019-18836
7.5 High
-
istio
Istio ReDoS Vulnerability
CVE-2019-14993
Fix available
7.5 High
-
istio
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error...
CVE-2019-12995
7.5 High
-
istio
Istio may not check inbound TCP connections against istio-policy
CVE-2019-12243
Fix available
7.5 High