VULNERABILITY INTELLIGENCE

CVE-2020-14306

CVSS score8.8 HIGH

EPSS probability1.30%

CISA KEVNot currently listed

Published2020-09-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Weakness classification

secalert@redhat.com: CWE-862
nvd@nist.gov: CWE-862

Primary references

secalert@redhat.com — Issue Tracking, Third Party Advisory
secalert@redhat.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory