Summary
Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with a #fragment in the URI path may bypass Istio's URI path-based authorization policies. The #fragment portion of a URI is not forwarded to the upstream service by standard HTTP clients, but the presence of the fragment alters path matching in the authorization evaluation.
Impact
Any AuthorizationPolicy that restricts access based on the URI path is potentially bypassable. An attacker who can reach the Istio ingress gateway or a sidecar-protected service can craft HTTP requests with a #fragment appended to the URI, circumventing path-based deny rules and allowing access to restricted endpoints. The CVSS score of 8.1 reflects network accessibility with no privilege required and a high confidentiality and integrity impact.
Detection
Inspect Istio access logs for requests containing # in the path field, which indicates possible exploitation attempts. Review existing AuthorizationPolicy resources to identify policies that rely on URI path matching — these are most at risk. Confirm whether affected Istio versions (1.11.0, 1.10.3 and below, 1.9.7 and below) are deployed in the cluster.
Mitigation
Upgrade Istio to a patched version on the appropriate release line:
- Istio 1.11.1 or later (for the 1.11 line)
- Istio 1.10.4 or later (for the 1.10 line)
- Istio 1.9.8 or later (for the 1.9 line)
As a workaround, a Lua filter can be written to normalize the path before the authorization check. This approach is similar to the path normalization described in the Istio Security Best Practices guide.