CVE-2021-34824

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-29 · updated 2026-06-17

Description

Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.

Affected products

istio: from 1.8.0 before 1.9.6; from 1.10.0 before 1.10.2 — fixed in 1.10.2, 1.9.6

How to fix

Upgrade to a fixed version: istio 1.10.2, 1.9.6. Check the vendor advisory for mitigations.

References

https://github.com/istio/istio/releases
https://istio.io/latest/news/security/istio-security-2021-007
https://github.com/istio/istio/releases
https://istio.io/latest/news/security/istio-security-2021-007

Get alerted when CVE-2021-34824 or the next vulnerability affects your stack