CVE-2026-31837
EUVD-2026-1093810.03.2026, 22:16
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| istio | istio | 𝑥 < 1.27.8 |
| istio | istio | 1.28.0 ≤ 𝑥 < 1.28.5 |
| istio | istio | 1.29.0 ≤ 𝑥 < 1.29.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 2.25 | 1776343082 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776343105 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776343121 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | 1774006090 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | 1774068855 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1774037369 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1774244136 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1774206464 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1774114903 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-1392 - Use of Default CredentialsThe product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
References