CVE-2020-14306

8.8 highEPSS 1.3%

High (8.8) in istio-operator project istio-operator. EPSS 1.3% chance of exploitation in the next 30 days.

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2020-09-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

istio-operator_project:istio-operator

References

https://bugzilla.redhat.com/show_bug.cgi?id=1850380
https://github.com/maistra/istio-operator/pull/462
https://bugzilla.redhat.com/show_bug.cgi?id=1850380
https://github.com/maistra/istio-operator/pull/462

Check your stack JSON