Istio Envoy RBAC Header Matching Authorization Bypass Vulnerability

A vulnerability exists in Istio versions prior to 1.29.1, 1.28.5, and 1.27.8, related to Envoy's Role-Based Access Control (RBAC) header matching. This vulnerability could allow an attacker to bypass authorization policies that depend on HTTP headers capable of containing multiple values. By crafting requests with specific multiple header values, an attacker could manipulate how Envoy interprets the headers, potentially evading authorization checks. As a result, unauthorized requests might reach protected services when the authorization policies rely on such header matching.

Impact

Exploitation of this vulnerability could lead to unauthorized access to services by bypassing header-based authorization checks, allowing unauthorized requests to reach protected resources.

Remediation

Users can upgrade to Istio versions 1.29.1, 1.28.5, or 1.27.8 to address this vulnerability.