CVE-2026-31837: Istio Information Disclosure Vulnerability

CVE-2026-31837 Overview

CVE-2026-31837 is a high-severity information disclosure vulnerability in Istio, an open platform used to connect, manage, and secure microservices. When the JWKS (JSON Web Key Set) resolver becomes unavailable or the fetch operation fails, Istio exposes hardcoded defaults regardless of the configured RequestAuthentication resource settings. This can lead to authentication bypass scenarios where security policies are not properly enforced, potentially allowing unauthorized access to protected services.

Critical Impact

JWKS resolver failures cause Istio to fall back to hardcoded defaults, bypassing configured authentication policies and potentially exposing protected microservices to unauthorized access.

Affected Products

• Istio versions prior to 1.29.1
• Istio versions prior to 1.28.5
• Istio versions prior to 1.27.8

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-31837 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31837

Vulnerability Analysis

This vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from improper error handling in Istio's JWKS resolver component. The JWKS resolver is responsible for fetching and validating JSON Web Keys used in JWT (JSON Web Token) authentication workflows. When external JWKS endpoints become unavailable due to network issues, misconfigurations, or targeted attacks, the resolver fails to properly enforce the configured RequestAuthentication policies.

Instead of denying requests or failing securely when JWKS resolution fails, Istio falls back to hardcoded default values. This behavior undermines the security guarantees expected from the RequestAuthentication resource, which administrators configure to enforce JWT validation requirements for their services. The vulnerability is particularly concerning in microservices architectures where JWT-based authentication is a cornerstone of service-to-service security.

Root Cause

The root cause lies in the fallback mechanism within Istio's JWKS resolver implementation. When the resolver cannot successfully fetch or validate JSON Web Keys from the configured JWKS URI, it defaults to hardcoded values rather than enforcing a fail-closed security posture. This design flaw means that temporary network outages, DNS resolution failures, or deliberate attacks against JWKS endpoints can cause authentication policies to be silently bypassed.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker could potentially exploit this vulnerability by:

1. Causing the JWKS endpoint to become unavailable through denial-of-service attacks or network manipulation
2. Exploiting network instability or misconfigurations that prevent JWKS resolution
3. Timing attacks during JWKS endpoint maintenance windows

Once the JWKS resolver fails, requests that should be rejected due to invalid or missing JWTs may be accepted, granting unauthorized access to protected services. The attack surface is particularly broad in environments where the JWKS endpoint is external to the cluster or traverses untrusted network paths.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-31837

Indicators of Compromise

• Unexpected increases in successful authentication events when JWKS endpoints are experiencing connectivity issues
• Log entries indicating JWKS fetch failures followed by requests being processed without proper JWT validation
• Unusual traffic patterns to services protected by RequestAuthentication policies during JWKS endpoint outages
• Authentication audit logs showing accepted requests that should have been rejected based on configured policies

Detection Strategies

• Monitor Istio proxy (Envoy) logs for JWKS resolution failures and correlation with authentication bypass events
• Implement alerting on JWKS endpoint health checks and availability metrics
• Audit authentication decision logs to identify requests accepted without proper JWT validation
• Deploy network monitoring to detect anomalous traffic to protected services during JWKS resolution failures

Monitoring Recommendations

• Configure continuous monitoring of JWKS endpoint availability and response times
• Set up alerts for Istio pilot logs indicating RequestAuthentication policy application failures
• Implement distributed tracing to track authentication decisions across the service mesh
• Monitor for unexpected changes in request success rates to JWT-protected endpoints

How to Mitigate CVE-2026-31837

Immediate Actions Required

• Upgrade Istio to patched versions: 1.29.1, 1.28.5, or 1.27.8 immediately
• Review all RequestAuthentication resources in your mesh to identify potentially affected services
• Audit access logs for services protected by JWT authentication during any recent JWKS endpoint outages
• Implement network-level controls to ensure JWKS endpoint availability and redundancy

Patch Information

This vulnerability is fixed in Istio versions 1.29.1, 1.28.5, and 1.27.8. Organizations should upgrade to the appropriate patched version based on their current release branch. The patches ensure that JWKS resolution failures result in request denial rather than falling back to insecure defaults.

For complete patch details and upgrade instructions, see the GitHub Security Advisory.

Workarounds

• Ensure high availability of JWKS endpoints by deploying redundant infrastructure and caching mechanisms
• Implement network policies that restrict access to protected services if JWKS resolution fails
• Consider deploying local JWKS caches or mirrors to reduce dependency on external endpoints
• Monitor JWKS endpoint health and implement automated failover mechanisms

# Verify current Istio version
istioctl version

# Upgrade to patched version (example for 1.29.1)
istioctl upgrade --set revision=1-29-1

# Verify RequestAuthentication policies
kubectl get requestauthentication --all-namespaces -o yaml