796 matches found
GHSA-9GCG-W975-3RJH vulnerabilities
Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-istio-csr-fips...
GHSA-9GCG-W975-3RJH vulnerabilities
Vulnerabilities for packages: cert-manager-istio-csr...
CVE-2026-39350 vulnerabilities
Vulnerabilities for packages: cert-manager-istio-csr...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, juicefs-csi-driver, kots, gitlab-runner, cilium-cli, istio, jitsucom-bulker, falcoctl, eksctl, kwok, skaffold, kubernetes, k8sgpt, kubernetes-dashboard-api, kiali, trivy, headlamp, argo-rollouts, kubevela, postgres-operator, k8sgpt-operator,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, juicefs-csi-driver, kots, gitlab-runner, cilium-cli, istio, jitsucom-bulker, falcoctl, eksctl, kwok, skaffold, kubernetes, k8sgpt, kubernetes-dashboard-api, kiali, trivy, headlamp, argo-rollouts, kubevela, postgres-operator, k8sgpt-operator,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: docker-cli-buildx, plugin-barman-cloud, percona-server-mongodb-operator, k9s-fips, kubescape-server-fips, eks-distro, rancher-support-bundle-kit, percona-xtradb-cluster-operator-fips, plugin-barman-cloud-fips, kubevela-fips, trident, commercial-grafana, grafana-fips,...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: docker-cli-buildx, plugin-barman-cloud, percona-server-mongodb-operator, k9s-fips, kubescape-server-fips, eks-distro, rancher-support-bundle-kit, percona-xtradb-cluster-operator-fips, plugin-barman-cloud-fips, kubevela-fips, trident, commercial-grafana, grafana-fips,...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
Istio: SSRF via RequestAuthentication jwksUri
Impact When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
GHSA-FGW5-HP8F-XFHC Istio: SSRF via RequestAuthentication jwksUri
Impact When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS...
CVE-2026-39350
A flaw was found in Istio, an open platform designed to connect, manage, and secure microservices. The serviceAccounts and notServiceAccounts fields within Istio's AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. This vulnerability allows an attacker to craft...
GHSA-9GCG-W975-3RJH Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots
Impact The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io,...
Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots
Impact The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io,...
Improper Neutralization
Overview Affected versions of this package are vulnerable to Improper Neutralization due to the serviceAccountRegex matcher in pilot/pkg/security/authz/model/generator.go. An attacker can gain access to workloads protected by AuthorizationPolicy rules by presenting a SPIFFE identity whose namespa...
CVE-2026-39350
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. Because . is...
CVE-2026-39350
CVE-2026-39350 (Istio) : The vulnerability affects Istio AuthorizationPolicy fields serviceAccounts and notServiceAccounts, where a dot (.) is incorrectly treated as a regular expression matcher. As a result, an ALLOW rule targeting a service account such as cert-manager.io can also match similar...
CVE-2026-39350 Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots . as a regular expression matcher. Because . is...