Vulnerabilities CVE-2026-31837

CVE-2026-31837

High

Open

TLP:CLEAR

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Details

CVSS Score: 8.7
EPSS Score ⓘ: 0.38%

30.8th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Mar 10, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.