High severity · published Mar 10, 2026
CVE-2026-31837
Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
istio · istio
>= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8 · source: vendor, NVD
OS
OpenShift Serverless · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Service Mesh 3.0 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Service Mesh 3.1 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift Service Mesh 3.2 · Red Hat
All versions, or not specified · source: CISA
CO
cert-manager Operator for Red Hat OpenShift · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31837
Vendor Advisory
https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10184
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5948
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5950
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5952
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-31837
More from istio
9.8
CVE-2022-31045
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2022-21679
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2021-31921
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing…
8.8
CVE-2022-21701
Istio is an open platform to connect, manage, and secure microservices
8.8
CVE-2021-34824
Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can…