CVE-2022-23635: Unauthenticated control plane denial of service attack in Istio
Summary
CVE-2022-23635: Unauthenticated control plane denial of service attack in Istio. Affects istio.io/istio across 3 version ranges.
< 1.11.7
>= 1.12.0, < 1.12.4
>= 1.13.0, < 1.13.1
Fixed in 1.11.7, 1.12.4 or 1.13.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices. It consists of a control plane, istiod, and a data plane that runs alongside application services. The control plane manages and configures the data plane to enforce policies and handle traffic routing. Istio is written in Go and is widely used in cloud-native environments to enhance the reliability and security of microservices-based applications.
Vulnerability Detail
The Istio control plane, istiod, is vulnerable to an unauthenticated control plane denial of service attack. An attacker can send a specially crafted message to the control plane, causing it to crash. This vulnerability exists in the request processing logic of istiod and can be exploited over TLS port 15012 without requiring any authentication. While the default configuration limits access to istiod within the cluster, certain deployments, such as multicluster topologies, may expose this port over the public internet. The impact of this vulnerability can be significant, leading to service disruptions and potential security breaches.
How To Fix
Latest published version: v0.0.0-20261021223355-ac152d313bbc as of 22 Oct 2026
go get istio.io/istio@v0.0.0-20261021223355-ac152d313bbcUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.11.71.11.7go get istio.io/istio@v1.11.7 -
>= 1.12.0, < 1.12.41.12.4go get istio.io/istio@v1.12.4 -
>= 1.13.0, < 1.13.11.13.1go get istio.io/istio@v1.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no effective workarounds for this vulnerability beyond upgrading Istio. However, limiting network access to istiod to only the necessary clients can help mitigate the risk to some extent. This can be achieved by configuring network policies or firewalls to restrict access to the TLS port 15012 used by istiod.
Conclusion
The Istio control plane is vulnerable to an unauthenticated control plane denial of service attack. Upgrading Istio to the recommended versions is the best way to address this vulnerability. Limiting network access to istiod can also help mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for istio.io/istio →
FAQ
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices-based applications.
The control plane in Istio, known as istiod, is responsible for managing and configuring the data plane to enforce policies and handle traffic routing.
This vulnerability allows an unauthenticated attacker to crash the Istio control plane, potentially leading to service disruptions and security breaches.
To fix this vulnerability, you should upgrade Istio to the recommended versions mentioned in the advisory.
While there are no effective workarounds, limiting network access to istiod can help reduce the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for istio.io/istio.
