Istio through 1.28.2 allows iptables rule injection for changing firewall behavior via the traffic.sidecar.istio.io/excludeInterfaces annotation. NOTE: the reporter's position is "this doesn't represent a security vulnerability (pod creators can already exclude sidecar injection entirely)."
Exploitability
AV:AAC:LPR:LUI:NScope
S:CImpact
C:NI:LA:N4.1/CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NOther