PT-2026-24489 · Istio · Istio

Hawton · Publicado 2026-03-10 · Atualizado 2026-04-01 · CVE-2026-31838

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.29.1 Istio versions prior to 1.28.5 Istio versions prior to 1.27.8

Description Istio is a platform designed for connecting, managing, and securing microservices. A flaw in Envoy RBAC header matching could permit bypassing authorization policies when those policies depend on HTTP headers that can have multiple values. An attacker could create requests with multiple header values, causing Envoy to evaluate the header in an unintended manner, potentially circumventing authorization checks. This could allow unauthorized requests to access protected services when policies rely on header-based matching. The issue involves how Envoy processes headers with multiple values during authorization checks.

Recommendations Update to Istio version 1.29.1 or later. Update to Istio version 1.28.5 or later. Update to Istio version 1.27.8 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CLEANSTART-2026-AS59691

CVE-2026-31838

GHSA-974C-2WXH-G4WW

Produtos afetados

Istio

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31838.json · Exploit
• https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww · Aviso do Fabricante
• https://github.com/istio/istio/commit/004fd6921314a8e2293fd195d91645dcbbff0aa1 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AS59691.json · Nota
• https://osv.dev/vulnerability/ghsa-9h8m-3fm2-qjrq · Nota
• https://osv.dev/vulnerability/CVE-2026-31837 · Nota
• https://osv.dev/vulnerability/CVE-2026-31838 · Aviso do Fabricante
• https://osv.dev/vulnerability/CLEANSTART-2026-AS59691 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031504060369539461 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-31837 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27139 · Nota
• https://osv.dev/vulnerability/CVE-2026-25679 · Nota
• https://osv.dev/vulnerability/CVE-2026-27142 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Nota de Segurança