GO-2026-5363 Istio: SSRF via RequestAuthentication jwksUri in istio.io/istio

Istio: SSRF via RequestAuthentication jwksUri in istio.io/istio...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...

PT-2026-37113

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.28.6 Istio versions prior to 1.29.2 Description When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without...

CVE-2026-31837

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This...