Summary
In Istio 1.15.2, a user who has localhost access to the Istiod control plane can impersonate any workload identity within the service mesh. This allows an attacker with such access to act as any service in the mesh, bypassing mTLS-based identity enforcement.
Impact
Exploitation requires the attacker to have local access to the node or pod where Istiod is running. With that access, the attacker can impersonate any workload identity in the mesh, which may allow them to intercept traffic intended for other services, bypass service-to-service authorization policies, or extract secrets distributed via the mesh. The CVSS score of 7.6 reflects the adjacent-network attack vector (local access required) and the high confidentiality impact.
Detection
Audit access controls for nodes hosting Istiod and review who has the ability to exec into or gain shell access on those nodes. Check Istiod audit logs and API server audit logs for unexpected certificate signing requests or identity-related API calls. If running Istio 1.15.2, treat any principal with local node access as a potential impersonation risk until upgraded.
Mitigation
Upgrade to Istio 1.15.3 or later. If using 1.15.2, upgrade immediately. There is no effective workaround; restrict access to nodes hosting Istiod as a defense-in-depth measure while planning the upgrade.