{"id":"CVE-2019-12243","aliases":["GHSA-6g5f-f5pm-mjrg"],"url":"https://o3.security/vulnerability/CVE-2019-12243","summary":"Istio may not check inbound TCP connections against istio-policy","details":"Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.\n\nThis behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.\n","published":"2019-06-05T15:29:01.373Z","modified":"2026-07-08T15:54:54.683005Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00897,"percentile":0.56435,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"istio.io/istio","fixedVersion":"1.1.7"}],"fix":{"url":"https://github.com/istio/istio/pull/13893/commits/91faba277439dab798185730d1624bd53e37bb06","label":"istio/istio#13893"},"references":[{"type":"ADVISORY","url":"https://istio.io/about/notes/"},{"type":"EVIDENCE","url":"https://istio.io/blog/2019/cve-2019-12243/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12243"},{"type":"WEB","url":"https://github.com/istio/istio/issues/13868"},{"type":"WEB","url":"https://github.com/istio/istio/pull/13893/commits/91faba277439dab798185730d1624bd53e37bb06"},{"type":"WEB","url":"https://istio.io/blog/2019/cve-2019-12243"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T15:54:54.683005Z"}}