Istio <1.29.1 JWKS Resolver Default Exfil Vulnerability
CVE-2026-31837 Published on March 10, 2026

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

NVD

Vulnerability Analysis

CVE-2026-31837 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Types

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2026-31837 has been classified to as an Information Disclosure vulnerability or weakness.

CWE-1392

Products Associated with CVE-2026-31837

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-31837 are published in these products:

Istio
 
Red Hat Openshift Ai
 
Red Hat Service Mesh
 
Red Hat Cert Manager
 
Red Hat Serverless
 
Red Hat Ext Dns Optr
 
Red Hat Ansible Automation Platform
 
Red Hat Connectivity Link
 

Affected Versions

istio: Red Hat OpenShift AI 2.25: Red Hat OpenShift Service Mesh 3.0: Red Hat OpenShift Service Mesh 3.1: Red Hat OpenShift Service Mesh 3.2: cert-manager Operator for Red Hat OpenShift: Red Hat OpenShift Serverless: Red Hat OpenShift AI (RHOAI): Red Hat ExternalDNS Operator: Red Hat OpenShift Service Mesh 2: Red Hat OpenShift Service Mesh 3: Red Hat Ansible Automation Platform 2: Red Hat Connectivity Link 1:

Exploit Probability

EPSS
0.28%
Percentile
19.49%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.