Advisories · Technology

istio.

Every CVE that names istio among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-31838 CVE record

CVSS 6.9 Medium

Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.
- istio
- Broken access control
Not analysed yet 10 Mar 2026
CVE-2026-31837 CVE record

CVSS 8.7 High

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
- istio
- Information disclosure
- CWE-1392
Not analysed yet 10 Mar 2026
CVE-2022-39278 CVE record

CVSS 7.5 High

Istio vulnerable to denial of service attack due to Golang Regex Library
- istio
- Denial of service
Not analysed yet 13 Oct 2022
CVE-2022-24726 CVE record

CVSS 7.5 High

Unauthenticated control plane denial of service attack in Istio
- istio
- Denial of service
Not analysed yet 10 Mar 2022
CVE-2022-21701 CVE record

CVSS 5.0 Medium

Privileged Escalation in Istio
- istio
- Broken access control
Not analysed yet 19 Jan 2022
CVE-2022-21679 CVE record

CVSS 6.8 Medium

Authorization Policy bypass in Istio
- istio
- CWE-670
Not analysed yet 19 Jan 2022