← CVE Intelligence

CVE-2026-31837

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. PUBLISHED

Description (CNA)

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Affected (CNA)

Vendor / productVersions
istio / istioaffected >= 1.29.0-alpha.0, < 1.29.1; affected >= 1.28.0-alpha.0, < 1.28.5; affected < 1.27.8

CWE

CWE-200

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Istio. A user of Istio could be impacted if the JSON Web Key Set (JWKS) resolver becomes unavailable or fails to fetch keys. This vulnerability can lead to the exposure of hardcoded default settings, potentially bypassing authentication mechanisms and allowing unauthorized access.