High severity7.6NVD Advisory· Published Nov 10, 2022· Updated Jun 17, 2026
CVE-2022-39388
CVE-2022-39388
Description
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/istio/istioGo | >= 1.15.0-beta.0, < 1.15.3 | 1.15.3 |
Affected products
3Patches
Vulnerability mechanics
References
7- github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32nvdPatchThird Party AdvisoryWEB
- github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-6c6p-h79f-g6p4ghsaADVISORY
- github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4nvdThird Party AdvisoryWEB
- istio.io/latest/news/releases/1.15.x/announcing-1.15.3/nvdRelease NotesVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2022-39388ghsaADVISORY
- istio.io/latest/news/releases/1.15.x/announcing-1.15.3ghsaWEB
News mentions
0No linked articles in our index yet.