What’s Vulnerable › Vulnerabilities

CVE-2020-16844

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-01 · updated 2026-06-17

Description

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.

Affected products

• istio: from 1.5.0 through 1.5.8; from 1.6.0 through 1.6.7

References

• https://github.com/istio/istio/releases
• https://istio.io/latest/news/security/istio-security-2020-009/
• https://github.com/istio/istio/releases
• https://istio.io/latest/news/security/istio-security-2020-009/

Get alerted when CVE-2020-16844 or the next vulnerability affects your stack