CVE-2022-39388

—

CVSS 3.1

3.5 low

EPSS

<1%p40

Published

Nov 10, 2022 (Nov 10, 2022)

Modified

Jun 17, 2026

Description

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

Vendors: istio
Products: istio
Weakness: CWE-863
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.