Istio
Istio is a platform-independent service mesh that provides traffic management, mTLS, and telemetry for Kubernetes workloads. It is widely deployed as the networking layer beneath AI inference platforms and multi-tenant cluster services. NVD tracks the control plane as istio:istio. The data plane runs Envoy Proxy; some advisories mention Envoy in text but Istio CPE rows scope control-plane CVEs.
Querying Istio
istio1.24.0, 1.15.0, 1.14.0curl "https://api.attestd.io/v1/check?product=istio&version=1.15.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Istio 1.15.0 is affected by CVE-2022-39278 (istiod crash via oversized webhook message when port 15017 is exposed). The response shows risk_state: "high".
{
"product": "istio",
"version": "1.15.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"active_exploitation",
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": true,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "1.28.6",
"confidence": 0.5,
"cve_ids": [
"CVE-2022-39278",
"CVE-2022-39388",
"CVE-2023-44487",
"CVE-2026-31837",
"CVE-2026-31838",
"CVE-2026-41413"
],
"cves": null,
"max_epss": 0.99999,
"last_updated": "2026-07-27T17:32:14.478599Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Istio 1.24.0 includes the upstream fixes for CVE-2022-39278.
curl "https://api.attestd.io/v1/check?product=istio&version=1.28.6" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Istio CVEs concentrate on the control plane (istiod), validating/mutating webhooks, and header parsing paths that reach Envoy. External-istiod topologies that expose webhook ports publicly carry higher blast radius for unauthenticated control-plane bugs.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2022-39278 | istiod crash via crafted or oversized message to validating/mutating webhook on port 15017. | < 1.15.2 | 7.5 |
CVE-2022-31045 | Ill-formed headers to Envoy in certain configurations cause unexpected memory access, undefined behavior, or crashing. | < 1.14.1 | 9.8 |
CVE-2022-24726 | istiod control plane crash via specially crafted request to the validating webhook on port 15017; no authentication required from the attacker. | < 1.13.2 | 7.5 |
CVE-2021-39156 | URI path authorization policy bypass: HTTP requests with a #fragment in the path evade path-based authorization rules. | < 1.11.1 | 8.1 |
CVE-2020-8595 | Authentication bypass: JWT exact-path matching can be defeated by appending ? or # to a URI, allowing access to protected paths without a valid token. | 1.3.0 to 1.4.3 | 7.3 |
CVE-2019-18817 | Denial of service when continue_on_listener_filters_timeout is set to true, causing an infinite loop on certain connections. | 1.3.x < 1.3.5 | 7.5 |