CVE-2022-21679 - CVE House
Back to Database
Status published Medium CVE-2022-21679

Authorization Policy bypass in Istio

Vulnerability Description

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-21679

Credits & Attribution

No credits recorded in the NVD database.

References

More from istio

View All →
CVE-2022-39388
Istio may allow identity impersonation if user has localhost access
High 7.6
CVE-2022-39278
Istio vulnerable to denial of service attack due to Golang Regex Library
High 7.5
CVE-2022-31045
Ill-formed headers may lead to unexpected behavior in Istio
High 7
CVE-2022-24726
Unauthenticated control plane denial of service attack in Istio
High 7.5
CVE-2022-23635
Unauthenticated control plane denial of service attack in Istio
High 7.5

Affected Vendor

Affected Software

istio
Vulnerable Versions:
>= 1.12.0, < 1.12.2

Timeline

Official Publish: January 19th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.