CVE-2020-1764
highpriority · attend · 45OT risk · highEPSS 0.035 · 89 %ileexploit · PoCEURUUSEPSS · scored 2026-10-26
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedopenshift-service-mesh/kiali-rhel7-operator@sha256:34da7505a15f2bfd5f17bdc46989cd2fea11d22fee8a834b8e2247dd8d63ae72_amd64 as a component of Red Hat OpenShift Service Mesh 1.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/4.3/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:0975 - Workaroundopenshift-service-mesh/kiali-rhel7-operator@sha256:34da7505a15f2bfd5f17bdc46989cd2fea11d22fee8a834b8e2247dd8d63ae72_amd64 as a component of Red Hat OpenShift Service Mesh 1.0redhat_csaf
The Kiali configuration can be manually updated for ServiceMesh so that the default signing_key cannot be easily determined: oc get kiali -n $(oc get kiali --all-namespaces --no-headers -o custom-columns=NS:.metadata.namespace) -o yaml | sed "s/spec:/spec:\n login_token:\n signing_key: $(chars=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890; for i in {1..20}; do echo -n "${chars:RANDOM%${#chars}:1}"; done; echo)/" | oc apply -f -
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.4
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- jpts/cve-2020-1764-pocAuth Bypass PoC for KialiPoC · poc_in_github
affected products (7)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- RHSA-2020:0975Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.10 openshift-istio-kiali-rhel7-operator-container security update2020-03-25csaf · redhat_csafUS
An update for openshift-istio-kiali-rhel7-operator-container is now available for Openshift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- GHSA-64rh-r86q-75ffHard coded cryptographic key in Kiali2021-05-18ghsa · osvUS
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
- GO-2022-0631Hard coded cryptographic key in Kiali in github.com/kiali/kiali2024-08-21vendor · osvUS
Hard coded cryptographic key in Kiali in github.com/kiali/kiali
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2020:0975Patchcnnvd
- https://access.redhat.com/security/cve/cve-2020-1764cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764cnnvd
- https://kiali.io/news/security-bulletins/kiali-security-001/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-1764cnnvd
- https://packetstormsecurity.com/files/156921/Red-Hat-Security-Advisory-2020-0975-01.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.1067/cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan