Medium severity · published Mar 10, 2026
CVE-2026-31838
Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching could allow authorization policy bypass when policies rely on HTTP headers that may contain multiple values. An attacker could craft requests with multiple header values in a way that causes Envoy to evaluate the header differently than intended, potentially bypassing authorization checks. This may allow unauthorized requests to reach protected services when policies depend on such header-based matching conditions. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
istio · istio
>= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31838
github.com
https://github.com/istio/istio/commit/004fd6921314a8e2293fd195d91645dcbbff0aa1
Vendor Advisory
https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww
More from istio
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2022-31045
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2022-21679
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2021-31921
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing…
8.8
CVE-2022-21701
Istio is an open platform to connect, manage, and secure microservices