CVE-2026-31838
Received Received - Intake
Authorization Bypass via Envoy RBAC Header Matching in Istio

Publication date: 2026-03-10

Last updated on: 2026-04-07

Assigner: GitHub, Inc.

Description
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching could allow authorization policy bypass when policies rely on HTTP headers that may contain multiple values. An attacker could craft requests with multiple header values in a way that causes Envoy to evaluate the header differently than intended, potentially bypassing authorization checks. This may allow unauthorized requests to reach protected services when policies depend on such header-based matching conditions. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-04-07
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-14
NVD
CVE-2026-31838
EUVD
EUVD-2026-10939
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
istio istio to 1.27.8 (exc)
istio istio From 1.28.0 (inc) to 1.28.5 (exc)
istio istio From 1.29.0 (inc) to 1.29.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Istio's Envoy RBAC header matching before versions 1.29.1, 1.28.5, and 1.27.8. It allows an attacker to bypass authorization policies that rely on HTTP headers containing multiple values. By crafting requests with multiple header values, the attacker can cause Envoy to evaluate the header differently than intended, potentially bypassing authorization checks.

Impact Analysis

The vulnerability can allow unauthorized requests to reach protected services when authorization policies depend on header-based matching conditions. This means attackers could gain access to services or data that should be restricted, potentially leading to unauthorized actions or data exposure.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Istio to one of the fixed versions: 1.29.1, 1.28.5, or 1.27.8.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart