VULNERABILITY INTELLIGENCE

CVE-2020-1764

CVSS score8.6 HIGH

EPSS probability3.47%

CISA KEVNot currently listed

Published2020-03-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Description

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

Weakness classification

secalert@redhat.com: CWE-321
nvd@nist.gov: CWE-798

Primary references

secalert@redhat.com — Issue Tracking, Mitigation, Third Party Advisory
secalert@redhat.com — Exploit, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Vendor Advisory