Summary
In Istio sidecars using TPROXY interception mode, the inbound iptables chain ISTIO_INBOUND contains the rule -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT, which marks and accepts packets without redirecting them to Envoy on port 15006. Netfilter retains the ESTABLISHED conntrack state for the entire lifetime of a conntrack entry, including closed connections that persist for nf_conntrack_tcp_timeout_close (default 10 seconds). If a client reuses the same source IP and port for a new connection to the same destination within that window, the new SYN matches the stale entry and bypasses Envoy entirely. The traffic reaches the application directly as plaintext, without PeerAuthentication STRICT mTLS enforcement or AuthorizationPolicy evaluation.
Impact
Deployments using TPROXY inbound interception are affected when clients with small fixed connection pools or high reconnect rates reuse a 4-tuple (source IP, source port, destination IP, destination port) of a recently closed connection within the 10-second conntrack timeout window. In that case, the new connection bypasses Envoy, defeating mesh-wide PeerAuthentication: STRICT mTLS enforcement and all AuthorizationPolicy rules — requests that should be denied reach the workload without any policy evaluation. Deployments using the default REDIRECT inbound interception mode are not affected.
Detection
Administrators can confirm exposure by checking the conntrack table on the affected node (conntrack -L) for CLOSE-state entries while simultaneously observing new connections reaching the application directly. In the affected scenario, Envoy's access log will have no entry for a request that the application received, and tcpdump on the application interface will show unencrypted bytes. Restricting the check to nodes where TPROXY interception is in use (ISTIO_INTERCEPTION_MODE=TPROXY) narrows the investigation surface.
Mitigation
Upgrade to Istio 1.31.4 (for 1.31.x deployments) or 1.30.8 (for 1.30.x deployments), which contain the fix for this conntrack bypass.
If an immediate upgrade is not possible, switch to the default REDIRECT inbound interception mode instead of TPROXY. Set the sidecar.istio.io/interceptionMode: REDIRECT pod annotation, or change the mesh-wide interceptionMode default. Note that REDIRECT mode does not preserve the original client source IP, which may affect applications that rely on it for access control or logging.
Related Security Guidance
- Service Mesh Security — Implementing mutual TLS, zero-trust networking, and policy-based access control with Istio and other service meshes.
- Traffic Hijacking — How attackers exploit gaps in Kubernetes network security controls to intercept and redirect traffic.
- Network Policies — Layering Kubernetes NetworkPolicy with service mesh policies for defense-in-depth.