CVE-2026-23766

istio: From CVEorg collector

View on CVE.org
Published Jan 15, 2026 CVSS 3.1 · 3.3 Low EPSS n/a KEV · Not listed
Description
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N'}

 cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already exclude sidecar injection entirely)." DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Type Values Removed Values Added
Title istio: From CVEorg collector
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
First Time appeared Istio
Istio istio
Vendors & Products Istio
Istio istio
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already exclude sidecar injection entirely)."
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N'}
Earlier changes (2)
Weaknesses

Sources

Status
REJECTED
Assigner
mitre
Published
Updated
Feb 14, 2026, 5:44 PM
Reserved
Jan 15, 2026, 12:00 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Jan 15, 2026, 8:16 PM
Modified
Feb 14, 2026, 6:16 PM

View source JSON

Severity
Low
Public date
Jan 15, 2026, 7:18 PM

View source Bugzilla JSON

No data.