Critical severity · published Jan 19, 2022
CVE-2022-21679
Istio is an open platform to connect, manage, and secure microservices
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Istio · Istio
1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21679
Third Party Advisory
https://github.com/istio/istio/security/advisories/GHSA-rwfr-xrvw-2rvv
Release Notes
https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2/
More from Istio
9.8
CVE-2022-31045
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2021-31921
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing…
8.8
CVE-2022-21701
Istio is an open platform to connect, manage, and secure microservices
8.8
CVE-2021-34824
Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can…
7.7
CVE-2026-41413
Istio Vulnerable to SSRF via RequestAuthentication jwksUri