Login Request a demo
IS
Product
istio
by istio · last CVE Oct 22, 2026
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities28In the news8Timeline
Severity mix
Critical 4High 17Medium 5Low 2
Severity
All severities28Critical4High17Medium5Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add istio to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-16844
6.8
1%
Oct 1
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g
Affected: 1.5.0 through 1.5.8; 1.6.0 through 1.6.7
CVE-2021-31920
6.5
1%
May 27
Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could…
Affected: before 1.8.6; 1.9.0 before 1.9.5
CVE-2019-25014
6.5
1%
Jan 29
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0
Affected: through 1.4.9
CVE-2026-39350
5.4
0%
Apr 15
Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
Affected: >= 1.25.0, < < 1.27.9; >= 1.28.0, < 1.28.6; >= 1.29.0, < 1.29.2
CVE-2026-31838
5.3
0%
Mar 10
Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.
Affected: >= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8
Showing 5