CVE-2022-39388

lowpriority · track · 14OT risk · elevatedEPSS 0.005 · 42 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.49% (42nd) EPSS

CVSS 3.5 · low

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

cvss

Technical severity, 0–10. One row per scoring source.

7.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.2–7.6

v3.13.5lowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.1 · impact 1.4

v3.17.6highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · ENISA EU

v3.17.6highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.3 · impact 4.7

v3.17.6highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:Nsecondary · OSV

v3.13.2lowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-863USprimaryCWE-863US

affected products (3)

Products and version ranges known to be affected.

istio istio1.15.0-beta.0, → 1.15.3enisa_euvdEU
istio istio1.15.0 → 1.15.2nvdUScpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
Go github.com/istio/istio1.15.0-beta.0 → 1.15.3osvUSpkg:golang/github.com/istio/istio

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-6c6p-h79f-g6p4Istio may allow identity impersonation if user has localhost access2022-11-09ghsa · osvUS
### Impact User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. ### Patches 1.15.3 ### Workarounds No. If using 1.15.2 please upgrade to 1.15.3 or later. ### References None at this time. ### For more information If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2022-11-10modified 2026-06-17

related (5,011)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-71362US	—OT critical	90.5% (100th)	KEV	2026-08-11
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated acc…
CVE-2026-42016US	high8.8OT critical	8.64% (95th)	KEV	2026-07-27
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s…
CVE-2025-55177US	—OT critical	13.1% (96th)	KEV	2025-08-29
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78…
CVE-2025-54253US	—OT critical	88.8% (100th)	KEV	2025-08-05
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this…
CVE-2025-21479US	—OT critical	0.84% (58th)	KEV	2025-06-03
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

+5006 more

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan