CVE-2022-39388: Istio may allow identity impersonation if user has localhost access
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39388?
CVE-2022-39388 is a vulnerability in Istio, where a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.
What is the severity of CVE-2022-39388?
The severity of CVE-2022-39388 is high, with a severity value of 3.5.
How can CVE-2022-39388 be exploited?
CVE-2022-39388 can be exploited by an attacker with localhost access to the Istiod control plane, allowing them to impersonate any workload identity within the service mesh.
How do I fix CVE-2022-39388?
To fix CVE-2022-39388, update Istio to version 1.15.3 or later, which contains a patch for this vulnerability.
Where can I find more information about CVE-2022-39388?
You can find more information about CVE-2022-39388 on the Istio GitHub repository and the Istio security advisories page.