Description
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| istio | istio | >= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8 |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift AI 2.25 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — |
| Red Hat | ExternalDNS Operator | — |
| Red Hat | ExternalDNS Operator | — |
| Red Hat | OpenShift Serverless | — |
| Red Hat | OpenShift Serverless | — |
| Red Hat | OpenShift Serverless | — |
| Red Hat | OpenShift Serverless | — |
| Red Hat | OpenShift Serverless | — |
| Red Hat | OpenShift Service Mesh 2 | — |
| Red Hat | OpenShift Service Mesh 2 | — |
| Red Hat | OpenShift Service Mesh 2 | — |
| Red Hat | OpenShift Service Mesh 2 | — |
| Red Hat | OpenShift Service Mesh 3 | — |
| Red Hat | OpenShift Service Mesh 3 | — |
| Red Hat | OpenShift Service Mesh 3 | — |
| Red Hat | OpenShift Service Mesh 3 | — |
| Red Hat | OpenShift Service Mesh 3 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — |
| Red Hat | Red Hat Connectivity Link 1 | — |
| Red Hat | Red Hat Connectivity Link 1 | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
References
- https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733cVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:5948
- https://access.redhat.com/errata/RHSA-2026:5950
- https://access.redhat.com/errata/RHSA-2026:5952
- https://access.redhat.com/security/cve/CVE-2026-31837
- https://bugzilla.redhat.com/show_bug.cgi?id=2446344
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31837.json
Timeline
- Published
- Mar 10, 2026
- Last modified
- Jul 20, 2026
- NVD status
- Modified