 based trigger rules. The logic for the exact path match in the Istio JWT filter includes query strings or fragments instead of stripping them off before matching. This means attackers can bypass the JWT validation by appending <code>?</code> or <code>#</code> characters after the protected paths.</li></ul><h2 id=mitigation>Mitigation</h2><ul><li>For Istio 1.3.x deployments: update to <a href=/v1.5/news/releases/1.3.x/announcing-1.3.8>Istio 1.3.8</a> or later.</li><li>For Istio 1.4.x deployments: update to 