Bug 2430117 (CVE-2026-23766)

Summary: CVE-2026-23766 istio: Istio: Firewall rule injection via annotation allows limited integrity impact
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: alebedev, anjoseph, asoldano, bbaranow, bmaxwell, brian.stansberry, carogers, darran.lofthouse, dhanak, dosoudil, drosa, dschmidt, dsimansk, erezende, fdeutsch, gmalinko, haoli, hkataria, istudens, ivassile, iweiss, jajackso, janstey, jcammara, jkoehler, jmitchel, jneedle, jprabhak, kegrant, kingland, koliveir, kshier, kverlaen, lphiri, mabashia, manissin, mattdavi, matzew, mnovotny, mosmerov, msvehla, nwallace, oramraz, pberan, pbohmill, pbraun, pdelbell, pesilva, pjindal, pmackay, rstancel, rstepani, sausingh, shvarugh, simaishi, smaestri, smcdonal, smullick, stcannon, stirabos, teagle, tfister, thason, thavo, tom.jenkinson, wtam, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-15 20:02:00 UTC 
Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already exclude sidecar injection entirely)."