Istio CVE-2026-31837

Exploitation requires that Istio's JWKS resolver be unavailable or that a JWKS fetch fail for an issuer configured in a RequestAuthentication resource; under that condition the proxy uses hardcoded defaults instead of the operator's keys, weakening JWT enforcement. The primary limiting factor is this precondition - under healthy JWKS resolution the fail-open default is not reached - so deployments using inline jwks (no network fetch) or with highly available JWKS endpoints are far less exposed. The flaw only matters where RequestAuthentication-based JWT authentication is actually configured and depended upon for access control; meshes not using request authentication are not meaningfully affected. Per the CVSS vector the request path is network-reachable and unauthenticated (PR:N).

Signals are mixed and warrant nuance. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) rates this 8.7 High, treating it as network-reachable, unauthenticated, low-complexity with high confidentiality impact and no integrity/availability impact. However, exploitation is explicitly conditioned on the JWKS resolver being unavailable or a fetch failing - a precondition the attacker does not directly control under default healthy operation - which in practice raises attack complexity or introduces an attack requirement beyond what AC:L/AT:N suggest; defenders should weigh this. Corroborating low-urgency signals: EPSS is 0.05% (15th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV. Net: a legitimate confidentiality/authorization-bypass concern for mesh operators relying on RequestAuthentication, but realistic risk is gated on a JWKS outage condition, so this is a patch-on-normal-cycle priority for most rather than an emergency, with elevated urgency for environments where JWKS endpoints are flaky or externally hosted.

An attacker targets a service mesh whose RequestAuthentication relies on a remotely fetched JWKS; during a JWKS endpoint outage (or by inducing one), the proxy falls back to hardcoded defaults and no longer correctly enforces JWT validation, letting the attacker reach protected endpoints with crafted or otherwise-rejected tokens. No public exploit is identified at time of analysis, and the CVSS network/low-complexity vector means the request itself is trivial to send once the JWKS fetch is failing.