Istio
Monthly
Istio versions prior to 1.29.1, 1.28.5, and 1.27.8 fall back to hardcoded default JWKS values when the resolver becomes unavailable or fails to fetch, potentially allowing attackers to bypass authentication controls configured via RequestAuthentication policies. This flaw exposes sensitive information and could enable unauthorized access to microservices when JWKS endpoints are unreachable. No patch is currently available for affected deployments.
Istio versions prior to 1.29.1, 1.28.5, and 1.27.8 fall back to hardcoded default JWKS values when the resolver becomes unavailable or fails to fetch, potentially allowing attackers to bypass authentication controls configured via RequestAuthentication policies. This flaw exposes sensitive information and could enable unauthorized access to microservices when JWKS endpoints are unreachable. No patch is currently available for affected deployments.