CVE-2026-31837
JWKS Resolver Failure in Istio Exposes Hardcoded Credentials
Publication date: 2026-03-10
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| istio | istio | to 1.27.8 (exc) |
| istio | istio | From 1.28.0 (inc) to 1.28.5 (exc) |
| istio | istio | From 1.29.0 (inc) to 1.29.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Istio, an open platform used to connect, manage, and secure microservices. Before versions 1.29.1, 1.28.5, and 1.27.8, if the JWKS (JSON Web Key Set) resolver became unavailable or if fetching the keys failed, Istio would expose hardcoded default keys. This exposure happens regardless of whether the RequestAuthentication resource is used, potentially allowing unauthorized access or bypassing authentication mechanisms.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker could exploit the failure of the JWKS resolver to cause Istio to use hardcoded default keys. This could lead to unauthorized access to microservices or bypassing of authentication controls, compromising the security of applications relying on Istio for service-to-service authentication.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Istio to version 1.29.1, 1.28.5, or 1.27.8 or later, as these versions contain the fix for the issue where the JWKS resolver becomes unavailable or fetch fails, exposing hardcoded defaults.