CVE-2020-1764

Published: Mar 26, 2020Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 3.9 / Impact: 4.7

Source: NVD

Description

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

Affected (2)

Products: Kiali: Kiali · Redhat: Openshift Service Mesh

1 product

1 product

Openshift Service Mesh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kiali Kiali	Before 1.15.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Service Mesh	Version 1.0

Related CWEs

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764

Source: secalert@redhat.com

Issue TrackingMitigationThird Party Advisory

https://kiali.io/news/security-bulletins/kiali-security-001/

Source: secalert@redhat.com

ExploitMitigationVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationThird Party Advisory

https://kiali.io/news/security-bulletins/kiali-security-001/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationVendor Advisory

Timeline

No history available yet.