JWKS Resolver Vulnerability in Istio by Istio
CVE-2026-31837

8.7HIGH

Key Information:

Vendor

Istio

Status
Istio
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31837?

Istio, a platform for managing and securing microservices, presents a security concern when the JWKS resolver is unavailable or fails. In versions prior to 1.29.1, 1.28.5, and 1.27.8, this issue exposes hardcoded defaults despite the presence of the RequestAuthentication resource, potentially leading to unauthorized access and compromised security protocols.

Affected Version(s)

istio >= 1.29.0-alpha.0, < 1.29.1 < 1.29.0-alpha.0, 1.29.1

istio >= 1.28.0-alpha.0, < 1.28.5 < 1.28.0-alpha.0, 1.28.5

istio < 1.27.8 < 1.27.8

References

https://github.com/istio/istio/security/advisories/GHSA-v...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.