CVE-2020-8843

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-14 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4.

Affected products

istio: from 1.3.0 through 1.3.6

References

https://github.com/istio/istio/commits/master
https://istio.io/news/security/
https://istio.io/news/security/istio-security-2020-002/
https://github.com/istio/istio/commits/master
https://istio.io/news/security/
https://istio.io/news/security/istio-security-2020-002/

Get alerted when CVE-2020-8843 or the next vulnerability affects your stack