One Key to Sign Them All : Forging Service Identity at the Mesh Boundary

Every service mesh gives each pod a cryptographic mTLS identity, but that identity is scoped to the connection. Inside the mesh, sidecar to sidecar, it's strictly enforced. The moment a request crosses a TLS-terminating boundary like an ingress or a hop to another cluster, the peer certificate doesn't travel with it, so the original identity can't cross the boundary and the platform falls back to a signed JWT minted by a gateway from a single private key. Where identity gets re-derived, and who can hold that key, decide whether the whole mesh can be impersonated.

​

We red-teamed a multi-cluster Kubernetes and Istio platform to test that model. Mapping which pods and IAM roles could read the signing key, we found it readable from more than one place, enough to mint a JWT claiming to be any service. Yet forging identity against an internal service failed three ways: the egress gateway re-signs the JWT from the caller's real mTLS certificate, Istio RequestAuthentication strips attacker-supplied claims, and an AuthorizationPolicy allowlist blocks the rest. We reproduce all three and show how we confirmed our forged identity was being overwritten.​