The Istio community quickly patched a "critical" security bug in its authentication policy that allowed an attacker unauthorized access to information without needing an authorized token.

The Istio security bug, CVE-2020-8595, was discovered by Aspen Mesh and scored a 9.0 out of 10 on the Common Vulnerability Scoring System (CVSS). Any score in that range is considered "critical." Aspen Mesh was also credited with quickly rolling out the code fix.

Istio versions impacted included 1.3 to 1.3.7, which were available between last September and earlier this month, and 1.4 to 1.4.3, which were available between last November and this week. The severity of the bug matched that of a pair of vulnerabilities discovered late last year.

Istio is a control plane for the management of a service mesh in a container environment. It sits at the network level and uses a substrate for microservices development and maintenance. This allows for the decoupling of management from application development. It can handle the deployment of Envoy sidecars – where Envoy sits next to a running container pod – and coordinate that deployment through the container orchestration layer working with platforms like Kubernetes.

Istio was developed by Google, Lyft, and IBM, and launched in mid-2017. Google has since taken on the primary management of the product, which has caused some consternation among open source proponents. Google and IBM are the dominate contributors to the project and also control the platform’s steering committee.

While its management remains under scrutiny, Istio has prospered in the burgeoning service mesh space. It’s been viewed by many as the most likely to emerge as a de-facto standard and has been linked into vendor platforms.