Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1077
_____________________________________________________________________

DATE                : 26/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running istio (Go) versions prior
                            to 1.29.9, 1.30.6, 1.31.2.

====================================================================
https://github.com/istio/istio/security/advisories/GHSA-w44g-8m76-8gc5
https://github.com/istio/istio/security/advisories/GHSA-7p2q-4xvg-vxc6
_____________________________________________________________________
 
AuthorizationPolicy method rules are bypassed over HTTP/2 by changing
the method caseg

High
PetrMc published GHSA-w44g-8m76-8gc5

Package
istio.io/istio (Go)

Affected versions
>= 1.30.0, < 1.30.6
>= 1.29.0, < 1.29.9
>= 1.31.0, < 1.31.2

Patched versions
1.30.6
1.29.9
1.31.2


Description

Impact

An AuthorizationPolicy DENY rule with methods (or an ALLOW rule with
notMethods) is compiled to a case-sensitive :method matcher. Over
HTTP/2 a request whose method differs only in case (e.g. post instead
of POST) does not match the rule and is forwarded to the workload,
bypassing the authorization policy. HTTP/1.1 is not affected because
the codec rejects non-uppercase methods before authorization.


Patches

Fixes are available in 1.29.9, 1.30.6 and 1.31.2


Workarounds

Use ALLOW policies with an explicit methods allow-list instead of
DENY / notMethods rules; a case-mismatched method does not match the
allow-list and is denied.


References

Same class as CVE-2021-39155 (case-sensitive host matching).

    #62289
    #62291
    #62293
    https://istio.io/latest/news/security/istio-security-2026-007/


Severity
High
7.4/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE ID
No known CVE

Weaknesses
No CWEs

Credits

    @izzysec izzysec Reporter

_____________________________________________________________________

istiod crash (DoS) when a ServiceEntry claims an IP-addressed
waypoint's address

High
PetrMc published GHSA-7p2q-4xvg-vxc6

Package
istio.io/istio (Go)

Affected versions
>= 1.29.0, < 1.29.9
>= 1.30.0, < 1.30.6
>= 1.31.0, < 1.31.2

Patched versions
1.29.9
1.30.6
1.31.2


Description

Summary

A ServiceEntry that claims an IP-addressed waypoint's address crashes istiod
mesh-wide (ambient mode) and it crash-loops until the ServiceEntry is
removed.


Details

In ambient mode istiod resolves an IP-addressed waypoint's owning service by
(network, IP), with no namespace in the key. The EDS shim uses krt.FetchOne over
the ServicesByAddress index in RegisterEdsShim
(pilot/pkg/serviceregistry/ambient/sidecar_interop.go); when two services share
the address it panics ("FetchOne found for more than 1 item") on a krt goroutine
and takes istiod down. A ServiceEntry with spec.addresses set to the waypoint
ClusterIP, in any namespace, creates the collision, and it persists so istiod
crash-loops until the ServiceEntry is deleted.


Patches

Fixes are available in 1.29.9, 1.30.6 and 1.31.2
Workarounds: delete the colliding ServiceEntry; restrict who may create
ServiceEntry resources; or avoid IP-addressed waypoints (a waypoint reports a
hostname by default, which is used instead).


Proof of concept

    Deploy an IP-addressed waypoint (annotate the Gateway
networking.istio.io/address-type: IPAddress so its status shows only the
ClusterIP, e.g. 10.223.9.31).
    Bind a service with istio.io/use-waypoint and istio.io/ingress-use-waypoint: "true".
    Create a ServiceEntry in any namespace with spec.addresses: ["10.223.9.31"].
    istiod panics and crash-loops within seconds; deleting the
ServiceEntry recovers it.


Impact

Denial of service against the istiod control plane. A tenant with
ServiceEntry-create in their own namespace can crash istiod for the
whole mesh by targeting a waypoint address in another namespace, crossing
a namespace boundary. Config distribution and certificate rotation stall
mesh-wide until the ServiceEntry is removed. Ambient mode with an
IP-addressed waypoint only.


References

    #62288
    #62290
    #62292
    https://istio.io/latest/news/security/istio-security-2026-007/


Severity
High
7.7/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CVE ID
No known CVE

Weaknesses
Weakness CWE-248

Credits

    @yshch yshch Reporter


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================