Authorization Policy bypass in Istio
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| istio | istio | 1.12.0 to before 1.12.2 | 1.12.2 | Patch available | CNA |
- istio Vendoristio Affected 1.12.0 to before 1.12.2 Fixed in 1.12.2 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:istio:istio:1.12.0:-:*:*:*:*:*:* | 1.12.0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha0:*:*:*:*:*:* | 1.12.0 alpha0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha1:*:*:*:*:*:* | 1.12.0 alpha1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha5:*:*:*:*:*:* | 1.12.0 alpha5 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta0:*:*:*:*:*:* | 1.12.0 beta0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta1:*:*:*:*:*:* | 1.12.0 beta1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta2:*:*:*:*:*:* | 1.12.0 beta2 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:rc1:*:*:*:*:*:* | 1.12.0 rc1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.1:*:*:*:*:*:*:* | 1.12.1 | Vulnerable | istio |
- cpe:2.3:a:istio:istio:1.12.0:-:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha0:*:*:*:*:*:* Versions 1.12.0 alpha0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha1:*:*:*:*:*:* Versions 1.12.0 alpha1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha5:*:*:*:*:*:* Versions 1.12.0 alpha5 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta0:*:*:*:*:*:* Versions 1.12.0 beta0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta1:*:*:*:*:*:* Versions 1.12.0 beta1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta2:*:*:*:*:*:* Versions 1.12.0 beta2 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.1:*:*:*:*:*:*:* Versions 1.12.1 Vulnerable ·istio
Remediation
- Fix · CNA istio (istio) Fixed in 1.12.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- OpenShift Service Mesh 2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21679
References
More Istio vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-11909 Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability… CVSS 3.1CRITICAL 9.8
- TI-2026-24390 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. CVSS 4.0HIGH 8.7
- TI-2022-13090 Ill-formed headers may lead to unexpected behavior in Istio CVSS 3.1CRITICAL 9.8
- TI-2022-18654 Istio vulnerable to denial of service attack due to Golang Regex Library CVSS 3.1HIGH 7.5
Sources
- CVE-2022-21679 · CVE Program
- CVE-2022-21679 · NVD
- FIRST EPSS
- CVE-2022-21679 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences