Privileged Escalation in Istio
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863.
Summary
Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have `CREATE` permission for `gateways.gateway.networking.k8s.io` objects can escalate this privilege to create other resources that they may not have access to, such as `Pod`. This vulnerability impacts only an Alpha level feature, the Kubernetes Gateway API. This is not the same as the Istio Gateway type (gateways.networking.istio.io), which is not vulnerable. Users are advised to upgrade to resolve this issue. Users unable to upgrade should implement any of the following which will prevent this vulnerability: Remove the gateways.gateway.networking.k8s.io CustomResourceDefinition, set PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER=true environment variable in Istiod, or remove CREATE permissions for gateways.gateway.networking.k8s.io objects from untrusted users.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| istio | istio | 1.12.0 to before 1.12.2 | 1.12.2 | Patch available | CNA |
- istio Vendoristio Affected 1.12.0 to before 1.12.2 Fixed in 1.12.2 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:istio:istio:1.12.0:-:*:*:*:*:*:* | 1.12.0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha0:*:*:*:*:*:* | 1.12.0 alpha0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha1:*:*:*:*:*:* | 1.12.0 alpha1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:alpha5:*:*:*:*:*:* | 1.12.0 alpha5 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta0:*:*:*:*:*:* | 1.12.0 beta0 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta1:*:*:*:*:*:* | 1.12.0 beta1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:beta2:*:*:*:*:*:* | 1.12.0 beta2 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.0:rc1:*:*:*:*:*:* | 1.12.0 rc1 | Vulnerable | istio |
| cpe:2.3:a:istio:istio:1.12.1:*:*:*:*:*:*:* | 1.12.1 | Vulnerable | istio |
- cpe:2.3:a:istio:istio:1.12.0:-:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha0:*:*:*:*:*:* Versions 1.12.0 alpha0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha1:*:*:*:*:*:* Versions 1.12.0 alpha1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:alpha5:*:*:*:*:*:* Versions 1.12.0 alpha5 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta0:*:*:*:*:*:* Versions 1.12.0 beta0 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta1:*:*:*:*:*:* Versions 1.12.0 beta1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:beta2:*:*:*:*:*:* Versions 1.12.0 beta2 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·istio
- cpe:2.3:a:istio:istio:1.12.1:*:*:*:*:*:*:* Versions 1.12.1 Vulnerable ·istio
Remediation
- Fix · CNA istio (istio) Fixed in 1.12.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
Not affected: 1 product
- OpenShift Service Mesh 2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21701
References
More Istio vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2022-06055 Authorization Policy bypass in Istio CVSS 3.1CRITICAL 9.8
- TI-2021-11909 Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability… CVSS 3.1CRITICAL 9.8
- TI-2026-24390 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. CVSS 4.0HIGH 8.7
- TI-2022-13090 Ill-formed headers may lead to unexpected behavior in Istio CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-21701 · CVE Program
- CVE-2022-21701 · NVD
- FIRST EPSS
- CVE-2022-21701 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences