CVE-2022-24726
mediumpriority · track · 31EPSS 0.016 · 76 %ileDEEUUSEPSS · scored 2026-10-27
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [external istiod](https://istio.io/latest/docs/setup/install/external-controlplane/) topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedservicemesh-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-0:2.1.2-4.el8.src as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-cni-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-cni-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-cni-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-agent-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-agent-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-discovery-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275 - Fixedservicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:1275
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (47)
Products and version ranges known to be affected.
- Red Hat OpenShift Container Platform 4all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4
advisories (2)
Vendor and ecosystem advisories describing this.
- RHSA-2022:1275Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2 security update2022-04-07csaf · redhat_csafUS
Red Hat OpenShift Service Mesh 2.1.2 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2022-0970Red Hat OpenShift: Mehrere SchwachstellenDeutsch2022-04-07csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2022-24726cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-24726/cnnvd
- https://github.com/golang/go/issues/51112cnnvd
- https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fdcnnvd
- https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6gcnnvd
- https://packetstormsecurity.com/files/166644/Red-Hat-Security-Advisory-2022-1275-01.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.1505cnnvd
- https://github.com/golang/go/issues/51112enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan