CVE-2026-31838: Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching could allow authorization policy bypass when policies rely on HTTP headers that may contain multiple values. An attacker could craft requests with multiple header values in a way that causes Envoy to evaluate the header differently than intended, potentially bypassing authorization checks. This may allow unauthorized requests to reach protected services when policies depend on such header-based matching conditions. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31838?
CVE-2026-31838 has a notable severity due to its potential to bypass namespace-based authorization.
How do I fix CVE-2026-31838?
To fix CVE-2026-31838, upgrade to Istio versions 1.29.1, 1.28.5, or 1.27.8 or later.
What types of systems are affected by CVE-2026-31838?
CVE-2026-31838 affects Istio versions prior to 1.29.1, 1.28.5, and 1.27.8.
What is the main issue caused by CVE-2026-31838?
CVE-2026-31838 allows potential unauthorized access to proxy data across namespaces due to Envoy RBAC header matching vulnerabilities.
Is there a workaround for CVE-2026-31838 if I can't upgrade?
Currently, the recommended approach is to upgrade, as there are no officially documented workarounds for CVE-2026-31838.