CVE-2021-39156: Istio Fragments in Path May Lead to Authorization Policy Bypass
Summary
CVE-2021-39156: Istio Fragments in Path May Lead to Authorization Policy Bypass. Affects istio.io/istio across 3 version ranges.
< 1.9.8
>= 1.10.0, < 1.10.4
>= 1.11.0, < 1.11.1
Fixed in 1.9.8, 1.10.4 or 1.11.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices. It is written in Go and is widely used in cloud-native applications. Istio's URI path based authorization policies allow administrators to control access to resources based on the path of the incoming HTTP requests.
Vulnerability Detail
Istio versions 1.11.0, 1.10.3 and below, and 1.9.7 and below are vulnerable to an authorization policy bypass. This vulnerability can be exploited remotely by sending an HTTP request with a #fragment in the path. The presence of the fragment can bypass Istio's URI path based authorization policies, potentially allowing unauthorized access to protected resources. The impact of this vulnerability is considered high, with a CVSS score of 8.1.
How To Fix
Latest published version: v0.0.0-20261021223355-ac152d313bbc as of 22 Oct 2026
go get istio.io/istio@v0.0.0-20261021223355-ac152d313bbcUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.9.81.9.8go get istio.io/istio@v1.9.8 -
>= 1.10.0, < 1.10.41.10.4go get istio.io/istio@v1.10.4 -
>= 1.11.0, < 1.11.11.11.1go get istio.io/istio@v1.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, a workaround can be implemented using a Lua filter to normalize the path. This workaround involves writing custom code to modify the incoming request path and remove any fragments. Detailed instructions for implementing this workaround can be found in the Istio Security Best Practices guide.
Conclusion
The vulnerability in Istio versions 1.11.0, 1.10.3 and below, and 1.9.7 and below allows for an authorization policy bypass when an HTTP request contains a #fragment in the path. Upgrading to the patched versions of Istio or implementing the provided workaround will mitigate this vulnerability. For further assistance or information, please contact istio-security-vulnerability-reports@googlegroups.com.
See every vulnerability recorded for istio.io/istio →
FAQ
The vulnerability allows an attacker to bypass Istio's URI path based authorization policies by including a #fragment in the request path. This can potentially lead to unauthorized access to protected resources.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Istio: 1.11.1 and above, 1.10.4 and above, or 1.9.8 and above.
Yes, a workaround can be implemented using a Lua filter to normalize the path and remove any fragments from the request. Detailed instructions for implementing this workaround can be found in the Istio Security Best Practices guide.
More details about this vulnerability can be found in the Istio Security Bulletin and the associated GitHub advisory.
For further support or questions regarding this vulnerability, you can email istio-security-vulnerability-reports@googlegroups.com.
Related vulnerabilities
Recent vulnerabilities recorded for istio.io/istio.
