Read the docs
TI-2026-24390 Aliases CVE-2026-31837

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Partial istio (istio): 1.29.1, 1.28.5, 1.27.8Red Hat: 4 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
istioistio1.29.0-alpha.0 to before 1.29.1; 1.28.0-alpha.0 to before 1.28.5; before 1.27.81.29.1, 1.28.5, 1.27.8Patch availableCNA
  • istio Vendoristio Affected 1.29.0-alpha.0 to before 1.29.1; 1.28.0-alpha.0 to before 1.28.5; before 1.27.8 Fixed in 1.29.1, 1.28.5, 1.27.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*before 1.27.8; 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.1Vulnerableistio
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* Versions before 1.27.8; 1.28.0 to before 1.28.5; 1.29.0 to before 1.29.1 Vulnerable ·istio

Remediation

  • Fix · CNA istio (istio) Fixed in 1.29.1, 1.28.5, 1.27.8

Red Hat 4 advisories

  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:5952 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.2.3
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:5950 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.1.6
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
Show 1 more Red Hat advisories
  • RHSA-2026:5948 Released 2026-03-26 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.0.9
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:5948
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:5950
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:5952
Not affected: 11 products
  • ExternalDNS Operator
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Connectivity Link 1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift Service Mesh 3.2
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31837
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-06055 Authorization Policy bypass in Istio CVSS 3.1CRITICAL 9.8
  • TI-2021-11909 Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2022-13090 Ill-formed headers may lead to unexpected behavior in Istio CVSS 3.1CRITICAL 9.8
  • TI-2022-18654 Istio vulnerable to denial of service attack due to Golang Regex Library CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences