8.7
High
CVE-2026-31837 Istio is an open platform to connect, manage, and secure microservices
Description
Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift AI 2.25 1776343121 | earliest → < 1776343121 | 1776343121 |
| Red Hat OpenShift Service Mesh 3.0 1774068855 | earliest → < 1774068855 | 1774068855 |
| Red Hat OpenShift Service Mesh 3.1 1774244136 | earliest → < 1774244136 | 1774244136 |
| Red Hat OpenShift Service Mesh 3.2 1774114903 | earliest → < 1774114903 | 1774114903 |
| cert-manager Operator for Red Hat OpenShift | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| ExternalDNS Operator | Versions not published | |
| OpenShift Service Mesh 2 | Versions not published |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| istio 1.29 | 1.29.0-alpha.0 → < 1.29.1 | 1.29.1 |
| istio 1.28 | 1.28.0-alpha.0 → < 1.28.5 | 1.28.5 |
| istio 1.27 | earliest → < 1.27.8 | 1.27.8 |
References
- github.com github.com
Timeline
- Published
- Last modified