CVE-2026-41413 | Medium | 5.0 | 2026-05-07 | Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created w… |
CVE-2026-39350 | Medium | 5.4 | 2026-04-15 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the servi… |
CVE-2026-31838 | Medium | 5.3 | 2026-03-10 | Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching coul… |
CVE-2026-31837 | High | 7.5 | 2026-03-10 | Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver b… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2022-39388 | High | 7.6 | 2022-11-10 | Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload i… |
CVE-2022-39278 | High | 7.5 | 2022-10-13 | Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1… |
CVE-2022-31045 | High | 7.0 | 2022-06-09 | Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lea… |
CVE-2022-24726 | High | 7.5 | 2022-03-10 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request proces… |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-21701 | Medium | 5.0 | 2022-01-19 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Use… |
CVE-2022-21679 | Medium | 6.8 | 2022-01-19 | Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be ac… |
CVE-2021-39156 | High | 8.1 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-39155 | High | 8.3 | 2021-08-24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggrega… |
CVE-2021-34824 | High | 8.8 | 2021-06-29 | Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule crede… |
CVE-2021-31921 | Critical | 9.8 | 2021-06-02 | Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster… |
CVE-2021-31920 | Medium | 6.5 | 2021-05-27 | Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters… |
CVE-2019-25014 | Medium | 6.5 | 2021-01-29 | A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is… |
CVE-2020-16844 | Medium | 6.8 | 2020-10-01 | In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *… |
CVE-2020-10739 | High | 7.5 | 2020-06-02 | Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet… |
CVE-2020-11767 | Low | 3.1 | 2020-04-15 | Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request… |
CVE-2020-8843 | High | 7.4 | 2020-02-14 | An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy a… |
CVE-2020-8595 | High | 7.3 | 2020-02-12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matc… |
CVE-2019-18817 | High | 7.5 | 2019-11-12 | Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836. |
CVE-2019-18836 | High | 7.5 | 2019-11-11 | Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in… |
CVE-2019-14993 | High | 7.5 | 2019-08-13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService… |
CVE-2019-12995 | High | 7.5 | 2019-06-28 | Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmenta… |
CVE-2019-12243 | High | 7.5 | 2019-06-05 | Istio 1.1.x through 1.1.6 has Incorrect Access Control. |