CVE-2026-31837: Istio Information Disclosure Vulnerability

CVE-2026-31837 Overview

CVE-2026-31837 is a high-severity information disclosure vulnerability in Istio, an open platform used to connect, manage, and secure microservices. When the JWKS (JSON Web Key Set) resolver becomes unavailable or the fetch operation fails, Istio exposes hardcoded defaults regardless of the configured RequestAuthentication resource settings. This can lead to authentication bypass scenarios where security policies are not properly enforced, potentially allowing unauthorized access to protected services.

Critical Impact
JWKS resolver failures cause Istio to fall back to hardcoded defaults, bypassing configured authentication policies and potentially exposing protected microservices to unauthorized access.

Affected Products

Istio versions prior to 1.29.1
Istio versions prior to 1.28.5
Istio versions prior to 1.27.8

Discovery Timeline

2026-03-10 - CVE CVE-2026-31837 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31837

Vulnerability Analysis

This vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from improper error handling in Istio's JWKS resolver component. The JWKS resolver is responsible for fetching and validating JSON Web Keys used in JWT (JSON Web Token) authentication workflows. When external JWKS endpoints become unavailable due to network issues, misconfigurations, or targeted attacks, the resolver fails to properly enforce the configured RequestAuthentication policies.

Instead of denying requests or failing securely when JWKS resolution fails, Istio falls back to hardcoded default values. This behavior undermines the security guarantees expected from the RequestAuthentication resource, which administrators configure to enforce JWT validation requirements for their services. The vulnerability is particularly concerning in microservices architectures where JWT-based authentication is a cornerstone of service-to-service security.

Root Cause

The root cause lies in the fallback mechanism within Istio's JWKS resolver implementation. When the resolver cannot successfully fetch or validate JSON Web Keys from the configured JWKS URI, it defaults to hardcoded values rather than enforcing a fail-closed security posture. This design flaw means that temporary network outages, DNS resolution failures, or deliberate attacks against JWKS endpoints can cause authentication policies to be silently bypassed.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker could potentially exploit this vulnerability by:

Causing the JWKS endpoint to become unavailable through denial-of-service attacks or network manipulation
Exploiting network instability or misconfigurations that prevent JWKS resolution
Timing attacks during JWKS endpoint maintenance windows

Once the JWKS resolver fails, requests that should be rejected due to invalid or missing JWTs may be accepted, granting unauthorized access to protected services. The attack surface is particularly broad in environments where the JWKS endpoint is external to the cluster or traverses untrusted network paths.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-31837

Indicators of Compromise

Unexpected increases in successful authentication events when JWKS endpoints are experiencing connectivity issues
Log entries indicating JWKS fetch failures followed by requests being processed without proper JWT validation
Unusual traffic patterns to services protected by RequestAuthentication policies during JWKS endpoint outages
Authentication audit logs showing accepted requests that should have been rejected based on configured policies

Detection Strategies

Monitor Istio proxy (Envoy) logs for JWKS resolution failures and correlation with authentication bypass events
Implement alerting on JWKS endpoint health checks and availability metrics
Audit authentication decision logs to identify requests accepted without proper JWT validation
Deploy network monitoring to detect anomalous traffic to protected services during JWKS resolution failures

Monitoring Recommendations

Configure continuous monitoring of JWKS endpoint availability and response times
Set up alerts for Istio pilot logs indicating RequestAuthentication policy application failures
Implement distributed tracing to track authentication decisions across the service mesh
Monitor for unexpected changes in request success rates to JWT-protected endpoints

How to Mitigate CVE-2026-31837

Immediate Actions Required

Upgrade Istio to patched versions: 1.29.1, 1.28.5, or 1.27.8 immediately
Review all RequestAuthentication resources in your mesh to identify potentially affected services
Audit access logs for services protected by JWT authentication during any recent JWKS endpoint outages
Implement network-level controls to ensure JWKS endpoint availability and redundancy

Patch Information

This vulnerability is fixed in Istio versions 1.29.1, 1.28.5, and 1.27.8. Organizations should upgrade to the appropriate patched version based on their current release branch. The patches ensure that JWKS resolution failures result in request denial rather than falling back to insecure defaults.

For complete patch details and upgrade instructions, see the GitHub Security Advisory.

Workarounds

Ensure high availability of JWKS endpoints by deploying redundant infrastructure and caching mechanisms
Implement network policies that restrict access to protected services if JWKS resolution fails
Consider deploying local JWKS caches or mirrors to reduce dependency on external endpoints
Monitor JWKS endpoint health and implement automated failover mechanisms

bash

# Verify current Istio version
istioctl version

# Upgrade to patched version (example for 1.29.1)
istioctl upgrade --set revision=1-29-1

# Verify RequestAuthentication policies
kubectl get requestauthentication --all-namespaces -o yaml