CVE-2026-23766: 
Istio Control Plane (istiod) vulnerability analysis and mitigation

CVE-2026-23766 is a rejected CVE that was originally reported as an iptables rule injection issue in Istio through version 1.28.2, exploitable via the traffic.sidecar.istio.io/excludeInterfaces annotation. The CVE was initially assigned on January 15, 2026, and subsequently withdrawn by its CNA (MITRE) on February 14, 2026, after further investigation determined it was not a security issue. The original reporter's own position was that "this doesn't represent a security vulnerability (pod creators can already exclude sidecar injection entirely)" (NVD, GitHub Issue). A CVSS v3.1 score of 4.1 (Medium) was initially assigned before the CVE was rejected (Feedly).

The originally reported issue involved insufficient input validation on the traffic.sidecar.istio.io/excludeInterfaces annotation in Istio, classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). A low-privileged pod creator on an adjacent network could supply a crafted annotation value such as eth0 -d 10.0.0.50 -p tcp --dport 8080, injecting additional iptables match parameters and potentially altering firewall behavior beyond the intended interface exclusion. The fix, merged in PR #58785, added validation enforcing Linux interface naming rules: maximum 15 characters, alphanumeric characters plus underscores, hyphens, and dots, with no spaces (GitHub Issue, GitHub PR). Because the CVE was ultimately rejected, this is treated as a hardening improvement rather than a security vulnerability.

As originally described, exploitation would have allowed a low-privileged pod creator to modify iptables firewall rules within the cluster scope, resulting in a limited integrity impact with no confidentiality or availability impact. The practical security consequence was considered negligible because pod creators already possess the ability to exclude sidecar injection entirely, granting them equivalent control over network traffic interception (GitHub Issue, NVD). Given the CVE's rejected status, no confirmed real-world security impact has been established.

This CVE has been officially rejected and is not considered a valid security vulnerability. The EPSS score is extremely low at 0.000190, reflecting negligible exploitation probability (Feedly). There is no evidence of in-the-wild exploitation, no known exploit code, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was reported by CrowdStrike but was assessed by the Istio maintainers as a non-security behavioral concern (GitHub Issue).

Although the CVE is rejected, the Istio project merged a hardening fix (PR #58785) into the master branch on January 20, 2026, adding input validation for the traffic.sidecar.istio.io/excludeInterfaces, kubevirtInterfaces, and reroute-virtual-interfaces annotations. Operators using Istio 1.28.2 or earlier who wish to apply this hardening should upgrade to a version that includes this fix (reported as Istio 1.28.3 or later per Feedly's summary). No configuration-based workaround is required given the non-security classification, but restricting who can create or modify pod annotations via Kubernetes RBAC is a general best practice (GitHub PR, Feedly).

The issue was originally reported by CrowdStrike and submitted to the Istio project as a potential security concern, though the reporter themselves noted it did not represent a security vulnerability. The Istio maintainers agreed and the CNA ultimately withdrew the CVE on February 14, 2026. Despite the rejection, the Istio community merged a code hardening fix to improve annotation input validation and prevent unintended behavior (GitHub Issue, NVD).