cve.bz

CVE-2022-39388

3.5 lowEPSS 0.5%

Low (3.5) in istio istio. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/istio/istio 1.15.3.

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

Severity

CVSS 3.1

3.5 low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6c6p-h79f-g6p4Gogithub.com/istio/istio>=1.15.0-beta.0 <1.15.31.15.3

References

Check your stackJSON