ISTIO-SECURITY-2026-009

CVE

Istio CVEs

• GHSA-rr2c-p22p-6r9r (CVSS score 8.2, High): In ambient mode, an operator-precedence error let a port-level STRICT PeerAuthentication be skipped when the workload mode was PERMISSIVE or DISABLE under a mesh-wide STRICT policy, allowing plaintext traffic to reach a port that required mTLS. Reported by Ravikanth Reddy.
• GHSA-7m6f-j3gp-2r53 (CVSS score 6.5, Moderate): An AuthorizationPolicy when condition on request.headers[:authority] or request.headers[host] was matched case-sensitively, so a request with a differently-cased host could bypass it. Reported by @akoul.
• GHSA-cxwg-46mx-q8hf (CVSS score 7.4, High): A new inbound connection reusing the 4-tuple of a torn-down connection could bypass the sidecar proxy by matching a stale conntrack ESTABLISHED entry. Reported by @ramaraochavali, @akshayreddyb, @Pawan-Bishnoi, and @deveshkandpal1224.
• GHSA-635j-qv98-9275 (CVSS score 7.7, High): Any workload with a mesh identity could crash istiod by sending an istio.io/debug xDS request whose resource name fails URL parsing, leaving the control plane in a crash loop for the whole mesh. Reported by Alon Lerner of Checkmarx Research.
• GHSA-8jw7-82jp-wr2c (CVSS score 6.3, Moderate): In ambient mode, an AuthorizationPolicy with an empty to or from entry that was not rejected by the validating webhook caused istiod to crash and crash-loop until the policy was removed. Reported by @r0binak.
• GHSA-gf6w-6mxv-5fj4 (CVSS score 6.3, Moderate): In multicluster installations, a proxy could claim another cluster’s CLUSTER_ID and receive that cluster’s kubernetes:// secrets over SDS. Reported by Yonghwa Lee (Xint by Theori).
• GHSA-77vw-rg85-wx5x (CVSS score 6.5, Moderate): ztunnel panicked when parsing a 55-byte traceparent header that did not contain four dash-separated fields, dropping every stream multiplexed on that inbound HBONE connection. Reported by @RaphaelFakhri.
• GHSA-9gqj-583v-mpqp (CVSS score 5.6, Moderate): AuthorizationPolicy ipBlocks, notIpBlocks and the source.ip condition on ambient waypoints, and on sidecars receiving HBONE traffic, matched the Envoy internal listener address instead of the client IP, so DENY rules on these fields could fail open. Reported by @adilfulara.

Other Istio Security Fixes

• The JWKS resolver’s periodic background refresh cached a fetched response without validating that it looked like a JWKS. The background refresh now applies the same check as the synchronous fetch path. Reported by Anthropic and Ada Logics.

Am I Impacted?

• Ambient mode: You are potentially impacted by GHSA-rr2c-p22p-6r9r and GHSA-8jw7-82jp-wr2c if you use ambient mode with PeerAuthentication or AuthorizationPolicy resources, respectively.
• Authorization: You are potentially impacted by GHSA-7m6f-j3gp-2r53 if you use AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host]. You are potentially impacted by GHSA-9gqj-583v-mpqp if you use ipBlocks, notIpBlocks or source.ip in policies that apply to ambient waypoints or to sidecars receiving HBONE traffic. As a workaround, use remoteIpBlocks, notRemoteIpBlocks and remote.ip instead.
• Sidecar interception: You are potentially impacted by GHSA-cxwg-46mx-q8hf if you use sidecar traffic interception with iptables or nftables.
• Multicluster: You are potentially impacted by GHSA-gf6w-6mxv-5fj4 if you run multicluster installations.
• Denial of service: All installations are potentially impacted by GHSA-635j-qv98-9275, and ambient mode installations by GHSA-77vw-rg85-wx5x.

Mitigation

• For Istio 1.31 users: upgrade to 1.31.4 or later.
• For Istio 1.30 users: upgrade to 1.30.8 or later.
• Please check the advisory information for each GHSA listed above for more details on the vulnerabilities and their mitigations.