WS-2026-0011

Server-side request forgery SSRF in Istio's Wasm OCI image fetcher. The validateRealmURL function in pkg/wasm/imagefetcher.go validates the WWW-Authenticate bearer realm returned by an OCI registry using net.ParseIP, which returns nil for hostnames, so IP-range blocking is skipped for any non-IP...