CVE-2021-31920

An authorization bypass flaw was found in Istio This flaw allows an attacker to craft an HTTP request that defines a certain pattern of escaped characters in the URI path (such as %2F, %2f, %5C, or %5c), allowing them to bypass the authorization service The highest threat from this vulnerability is to data confidentiality and integrity as well as ...

Istio before version 195 contains a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used ...