istio vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 20227
3. 20264

Newest CVEs

• CVE-2026-41413

  Istio Vulnerable to SSRF via RequestAuthentication jwksUri

  istio · istio

  Medium5.0
• CVE-2026-39350

  Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

  istio · istio

  Medium5.4
• CVE-2026-31838

  Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.

  istio · istio

  Medium6.9
• CVE-2026-31837

  Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

  istio · istio

  High8.7
• CVE-2022-39388

  Istio may allow identity impersonation if user has localhost access

  istio · istio

  High7.6
• CVE-2022-39278

  Istio vulnerable to denial of service attack due to Golang Regex Library

  istio · istio

  High7.5
• CVE-2022-31045

  Ill-formed headers may lead to unexpected behavior in Istio

  istio · istio

  High7.0
• CVE-2022-24726

  Unauthenticated control plane denial of service attack in Istio

  istio · istio

  High7.5
• CVE-2022-23635

  Unauthenticated control plane denial of service attack in Istio

  istio · istio

  High7.5
• CVE-2022-21701

  Privileged Escalation in Istio

  istio · istio

  Medium5.0