Database/Container, Kubernetes & orchestration
Istio: With AUTO_PASSTHROUGH gateways, an external client reaches arbitrary in-cluster services, bypassing
CVSS 9.8CVE-2021-31921Container, Kubernetes & orchestrationcurated
Impact
With AUTO_PASSTHROUGH gateways, an external client reaches arbitrary in-cluster services, bypassing all authorization
Who can reach it
Unauthenticated network via the ingress gateway
What to do
Emergency istiod and gateway upgrade; audit for AUTO_PASSTHROUGH gateways
References
Related entries
- Istio: Gateway/DestinationRule credentialName can read TLS secrets from other namespacesCVE-2021-34824 · IstioHigh
- Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
- Istio: Case-sensitivity mismatch in host matching bypasses authorization policyCVE-2021-39155 · IstioHigh
- Istio: Host header with a port bypasses AuthorizationPolicy host matchingCVE-2021-39156 · IstioHigh
- Istio: Localhost access to the istiod pod lets a user impersonate any workload identity in the meshCVE-2022-39388 · IstioHigh
- Istio: Crafted message crashes istiodCVE-2022-23635 · IstioHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.