CVE-2020-16844: Authorization bypass in Istio
Summary
CVE-2020-16844: Authorization bypass in Istio. Affects istio.io/istio across 2 version ranges.
>= 1.5.0, < 1.5.9
>= 1.6.0, < 1.6.8
Fixed in 1.5.9 or 1.6.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices. It is written in Go and is widely used in cloud-native applications. Istio allows users to define AuthorizationPolicy resources to control access to services based on various criteria. However, versions 1.5.0 through 1.5.8 and 1.6.0 through 1.6.7 of Istio have a vulnerability that allows an attacker to bypass the intended authorization policy. This vulnerability can lead to unauthorized access to services and potential data breaches.
Vulnerability Detail
The vulnerability (CVE-2020-16844) in Istio occurs when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g., *-some-suffix) for source principals or namespace fields. Due to a flaw in the implementation, callers will never be denied access, bypassing the intended policy. This means that even if a policy is defined to deny access to certain source principals or namespaces, the attacker can still gain access to the services protected by Istio.
How To Fix
Latest published version: v0.0.0-20261021223355-ac152d313bbc as of 22 Oct 2026
go get istio.io/istio@v0.0.0-20261021223355-ac152d313bbcUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.5.0, < 1.5.91.5.9go get istio.io/istio@v1.5.9 -
>= 1.6.0, < 1.6.81.6.8go get istio.io/istio@v1.6.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of Istio to mitigate the risk.
Conclusion
The vulnerability in Istio (CVE-2020-16844) allows an attacker to bypass authorization policies, potentially leading to unauthorized access to services. It is crucial to upgrade to the fixed versions of Istio (1.5.9 or 1.6.8) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for istio.io/istio →
FAQ
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices.
An AuthorizationPolicy resource in Istio allows users to define access control policies for services based on various criteria such as source principals and namespaces.
The vulnerability allows an attacker to bypass the intended authorization policy, potentially leading to unauthorized access to services and data breaches.
No, only versions 1.5.0 through 1.5.8 and 1.6.0 through 1.6.7 of Istio are affected. The fixed versions are 1.5.9 and 1.6.8, respectively.
No, there is no known workaround. It is necessary to upgrade to the fixed versions of Istio.
References
Related vulnerabilities
Recent vulnerabilities recorded for istio.io/istio.
