CVE-2020-16844: istio
Vulnerability summary
CVE-2020-16844 is a medium (CVSS 6.8) vulnerability in istio. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 01-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · GoEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (istio.io)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat9 products
- servicemesh< 0:1.1.7-1.el8
- servicemesh-citadel< 0:1.1.7-1.el8
- servicemesh-galley< 0:1.1.7-1.el8
- servicemesh-istioctl< 0:1.1.7-1.el8
- servicemesh-mixc< 0:1.1.7-1.el8
Istio1 product
- istio≥ 1.5.0, ≤ 1.5.8 | ≥ 1.6.0, ≤ 1.6.7
Istio.io1 product
- istio≥ 1.5.0, < 1.5.9 | ≥ 1.6.0, < 1.6.8
3 vendors · 11 products
References
16 links- istio.io/latest/news/security/istio-security-2020-009/X Refsource CONFIRMARTICLEExploitMitigationVendor Advisory
