PT-2026-24489 · Istio · Istio

Hawton · Published 2026-03-10 · Updated 2026-04-01 · CVE-2026-31838

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.29.1 Istio versions prior to 1.28.5 Istio versions prior to 1.27.8

Description Istio is a platform designed for connecting, managing, and securing microservices. A flaw in Envoy RBAC header matching could permit bypassing authorization policies when those policies depend on HTTP headers that can have multiple values. An attacker could create requests with multiple header values, causing Envoy to evaluate the header in an unintended manner, potentially circumventing authorization checks. This could allow unauthorized requests to access protected services when policies rely on header-based matching. The issue involves how Envoy processes headers with multiple values during authorization checks.

Recommendations Update to Istio version 1.29.1 or later. Update to Istio version 1.28.5 or later. Update to Istio version 1.27.8 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CLEANSTART-2026-AS59691

CVE-2026-31838

GHSA-974C-2WXH-G4WW

Affected Products

Istio

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31838.json · Exploit
• https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31838 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-AS59691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31837 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31838 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24051 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://github.com/istio/istio/commit/004fd6921314a8e2293fd195d91645dcbbff0aa1 · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AS59691.json · Note
• https://osv.dev/vulnerability/ghsa-9h8m-3fm2-qjrq · Note
• https://osv.dev/vulnerability/CVE-2026-31837 · Note
• https://twitter.com/CVEnew/status/2031504060369539461 · Twitter Post