CVE-2020-1764: kiali Use of Hard-coded Cryptographic Key

EPSS trend

Probability

3.47%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.47% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (kiali.io)
Maturity: unknown

References

11 links

kiali.io/news/security-bulletins/kiali-security-001/X Refsource MISCExploitMitigationVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764X Refsource CONFIRMWEBIssue TrackingMitigationThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2020-1764Advisory
github.com/kiali/kiali/commit/93f5cd0b6698e8fe8772afb8f35816f6c086aef1WEBFIX
github.com/kiali/kiali/commit/ac7bd6c7ddb2e01356e21d360dd1c718a90706adWEBFIX
github.com/kiali/kiali/commit/ce48af57113c805a25179aaab1a0fac2fb93653fWEBFIX
github.com/kiali/kiali/commit/faed1f5f90efae3df9fd6fb793f00ccc242b3a96WEBFIX
bugzilla.redhat.com/show_bug.cgi?id=1810383WEB
github.com/jpts/cve-2020-1764-pocWEB
kiali.io/news/security-bulletins/kiali-security-001WEB

Show all 11 references

github.com/advisories/GHSA-64rh-r86q-75ffAdvisory

Related vulnerabilities

CVE-2021-20278github.com/kialikiali+10.76%5y ago28-05-2021 10:42An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.CVE-2021-3495github.com/kialikiali+20.97%5y ago01-06-2021 13:31An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-3586redhatopenshift_service_mesh+21.03%4y ago22-08-2022 14:46A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2025-0752redhatopenshift_service_mesh0.41%1y ago28-01-2025 09:29A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.CVE-2020-1704red hatopenshift-service-mesh/kiali-rhel7-operator+10.27%6y ago17-02-2020 16:38An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.CVE-2020-1762github.com/kialikiali+21.15%6y ago27-04-2020 20:41An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

All vulnerabilities inkiali kiali openshift_service_mesh

CVE-2020-1764: kiali Use of Hard-coded Cryptographic Key

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References