Loading vulnerability…
CVE-2021-39156 is a remotely exploitable authorization bypass in Istio URI path-based authorization policies. In Istio 1.11.0, 1.10.3 and earlier, and 1.9.7 and earlier, an HTTP request whose path contains a fragment character may bypass configured URI path authorization policy checks.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small proof-of-concept microservices lab rather than a traditional standalone exploit script. It contains six minimal FastAPI services (api-gateway, user-service, product-service, payment-service, order-service, notification-service), each packaged with a Dockerfile and simple app structure (main.py, routes.py, models.py, service.py, config.py). Kubernetes manifests under k8s/ deploy the services into a 'microservices' namespace with Istio sidecar injection enabled, expose the api-gateway through an Istio Gateway and VirtualService, and apply an AuthorizationPolicy intended to deny access to /admin on user-service. The key exploit logic is in api-gateway/app/routes.py. The externally reachable /admin route on the api-gateway performs a server-side request to http://user-service/admin and returns the JSON response. Meanwhile, user-service/app/routes.py defines /admin to return sensitive data: {"secret": "admin data"}. The repository’s purpose appears to be demonstrating an authorization or service-mesh policy bypass pattern: although direct access to user-service /admin is denied by Istio policy, the api-gateway can still reach it internally and expose the result to an external caller. This is effectively a network-based access-control bypass / confused-deputy style proxy issue. Most other services are placeholders with only / and /health endpoints and no exploit logic. There is no advanced payload, persistence, RCE, or post-exploitation capability. The code is minimal and operational only as a demo environment, so the maturity is best classified as POC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.