A flaw in Envoy’s RBAC header matching allows an attacker to supply multiple values for a header that a policy relies on, causing Envoy to process the header differently than expected. This flaw can bypass authorization checks that depend on header-based conditions, enabling unauthorized requests to reach protected services. The weakness is rooted in improper handling of multi‑valued headers and results in a loss of confidentiality and integrity for services trusting such policies.

The issue affects Istio deployments running versions prior to 1.29.1, 1.28.5, and 1.27.8. Any impacted installation that uses Envoy RBAC policies with header matching is susceptible, regardless of the underlying microservices architecture.

The vulnerability has a CVSS score of 6.9, indicating moderate severity, and an EPSS score of less than 1%, showing a low but non‑zero probability of exploitation. It is not listed in CISA’s KEV catalog. Likely exploitation requires the attacker to have network access to the Istio control plane or ingress that can inject requests with crafted headers. Once a request is accepted, the attacker may access services or internal resources that the policy should restrict.