High severity · published May 7, 2026
CVE-2026-41413
Istio Vulnerable to SSRF via RequestAuthentication jwksUri
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
istio · istio
< 1.28.6; >= 1.29.0-alpha.0, < 1.29.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41413
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41413
Release Notes
https://github.com/istio/istio/releases/tag/1.28.6
Release Notes
https://github.com/istio/istio/releases/tag/1.29.2
Mitigation
https://github.com/istio/istio/security/advisories/GHSA-fgw5-hp8f-xfhc
More from istio
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2022-31045
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2022-21679
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2021-31921
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing…
8.8
CVE-2022-21701
Istio is an open platform to connect, manage, and secure microservices