Istio contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.
|CVSS Impact Score||9.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L|
|Affected Releases||All 1.8 patch releases|
1.9.0 to 1.9.5
1.10.0 to 1.10.1
DestinationRule can load private keys and certificates from Kubernetes
secrets via the
For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.
In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.
Am I impacted?
Your cluster is impacted if ALL of following conditions are true:
- It is using Istio 1.10.0 to 1.10.1, Istio 1.9.0 to 1.9.5 or Istio 1.8.x.
- It has defined
- It does not specify the Istiod flag
Update your cluster to the latest supported version:
- Istio 1.9.6 or up, if using 1.9.x
- Istio 1.10.2 or up, if using 1.10.x
- The patch version specified by your cloud provider
If an upgrade isn’t feasible, this vulnerability can be mitigated by disabling Istiod caching.
Caching is disabled by setting an Istiod environment variable
System and Istiod performance may be impacted as this disables XDS caching.
We would like to thank the team at
Sopra Banking Software (
Stephane Mercier and
as well as John Howard (Google) for reporting this issue.