CVE-2026-31837

No fix known EPSS <1%CVSS 8.7

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Published 2026-03-10 · CVE record · OSV

Products: istio, Red Hat OpenShift AI 2.25, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2, cert-manager Operator for Red Hat OpenShift, Red Hat ExternalDNS Operator, Red Hat OpenShift Serverless, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Connectivity Link 1, Red Hat OpenShift AI (RHOAI)

Distro releases