CVE-2020-14306

HIGH 8.8CVE-2020-14306 · Published 16/09/2020 · updated 17/06/2026

In short

CVE-2020-14306 is a HIGH (CVSS 8.8) vulnerability affecting istio-operator (istio-operator project).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
istio-operator istio-operator_project	`≤ 1.1.3`	No fix yet

Description

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

bugzilla.redhat.com/show_bug.cgi · Issue Tracking
maistra/istio-operator#462 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free