CVE-2022-23635

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.

• CWE-287
• CWE-1284

• https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84Patch, Third Party Advisory
• https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2fIssue Tracking, Third Party Advisory
• https://istio.io/latest/news/security/istio-security-2022-003Third Party Advisory
• https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84Patch, Third Party Advisory
• https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2fIssue Tracking, Third Party Advisory
• https://istio.io/latest/news/security/istio-security-2022-003Third Party Advisory

Published

Feb 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2363A vulnerability, which was classified as problematic, has be…4.6
• CVE-2022-23630Gradle is a build tool with a focus on build automation and …7.5
• CVE-2022-23631superjson is a program to allow JavaScript expressions to be…9.8
• CVE-2022-23632Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
• CVE-2022-23633Action Pack is a framework for handling and responding to we…5.9
• CVE-2022-23634Puma is a Ruby/Rack web server built for parallelism. Prior …5.9
• CVE-2022-23636Wasmtime is an open source runtime for WebAssembly & WASI. P…8.1
• CVE-2022-23637K-Box is a web-based application to manage documents, images…5.4
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-23639crossbeam-utils provides atomics, synchronization primitives…8.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8