Database/Container, Kubernetes & orchestration
Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP paths
CVSS 7.3CVE-2020-8595Container, Kubernetes & orchestrationcurated
Impact
Authentication Policy exact-path matching allows unauthorized access to HTTP paths
Who can reach it
Unauthenticated network
What to do
Rolling istiod upgrade plus sidecar restart; sidecar restart means restarting tenant pods
References
Related entries
- Istio: Envoy RBAC header matching flaw bypasses header-based authorization policyCVE-2026-31838 · IstioMedium
- Istio: DENY AuthorizationPolicy with wildcard-suffix principals silently fails to denyCVE-2020-16844 · IstioMedium
- Istio: Multiple or escaped slashes bypass an Istio authorization policyCVE-2021-31920 · IstioMedium
- Istio: serviceAccounts and notServiceAccounts in AuthorizationPolicy are evaluated incorrectlyCVE-2026-39350 · IstioMedium
- Istio: A user with CREATE on Gateway API resources escalates privilege in istiodCVE-2022-21701 · IstioMedium
- Istio: A RequestAuthentication jwksUri pointed at an internal service makes istiod issue an unauthenticated requestCVE-2026-41413 · IstioMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.