CVE-2026-31837: 
Istio Control Plane (istiod) vulnerability analysis and mitigation

CVE-2026-31837 is an authentication bypass vulnerability in Istio, the open-source service mesh platform, caused by JWKS resolver failure exposing hardcoded default keys. When the JWKS (JSON Web Key Set) resolver becomes unavailable or a fetch fails, Istio falls back to hardcoded defaults regardless of any configured RequestAuthentication resource, potentially allowing unauthenticated access to protected services. The vulnerability affects Istio versions prior to 1.27.8, 1.28.5, and 1.29.1, and was disclosed on March 10, 2026. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from Istio's failure-mode behavior when its JWKS resolver cannot retrieve public keys for JWT validation. Instead of failing closed (denying requests), the system falls back to hardcoded default authentication values, effectively bypassing the intent of any RequestAuthentication policy configured by the operator. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity — an attacker simply needs to trigger or wait for a JWKS resolver outage (e.g., network partition, DNS failure, or upstream JWKS endpoint unavailability) and then send requests that would otherwise be rejected. No public proof-of-concept exploit code has been identified (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to bypass JWT-based authentication controls enforced by Istio's RequestAuthentication resource, gaining unauthorized access to microservices that rely on Istio for authentication enforcement. The primary impact is a high confidentiality risk — sensitive data exposed by backend services becomes accessible without valid credentials. There is no direct integrity or availability impact from the vulnerability itself, but unauthorized access could enable lateral movement within a service mesh environment or exfiltration of sensitive application data (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.05%, reflecting a low probability of near-term exploitation. However, the low attack complexity and lack of authentication requirements make it a viable target if JWKS resolver disruption can be induced or coincides with a natural outage.

1. Reconnaissance: Identify target environments running Istio versions prior to 1.27.8, 1.28.5, or 1.29.1 that use RequestAuthentication resources with external JWKS URIs for JWT validation.
2. Induce or await JWKS resolver failure: Cause the JWKS endpoint to become unreachable (e.g., via network disruption, DNS poisoning, or targeting the JWKS hosting service) or wait for a natural outage of the external JWKS provider.
3. Send unauthenticated or invalid JWT requests: Submit HTTP requests to services protected by Istio's RequestAuthentication policy without a valid JWT token, or with a token signed by an arbitrary key.
4. Bypass authentication: Because Istio falls back to hardcoded default keys during JWKS resolver failure, the authentication check is bypassed and the request is forwarded to the backend service.
5. Access protected resources: Interact with the backend microservice as if authenticated, potentially exfiltrating sensitive data or performing unauthorized operations (GitHub Advisory).

• Logs: Istio proxy (Envoy) logs showing JWKS fetch failures or resolver errors (e.g., Failed to fetch public key from JWKS URI) followed by requests that succeed without valid JWT tokens; unusual access patterns to backend services during periods of JWKS resolver unavailability.
• Network: Unexpected outbound connection failures from Istio sidecars to the configured JWKS URI endpoint; requests to protected services lacking Authorization headers or containing malformed/unsigned JWTs that are not rejected.
• Metrics: Spikes in Istio telemetry showing authentication policy evaluation errors or fallback events; increased request success rates to JWT-protected endpoints during JWKS outage windows.
• Configuration: Presence of RequestAuthentication resources with external jwksUri values pointing to potentially unreliable or attacker-influenced endpoints.

Upgrade Istio to the patched versions: 1.29.1, 1.28.5, or 1.27.8. The official advisory notes that if a JWKS resolver is in use, there is no effective workaround short of upgrading. Operators should also ensure JWKS resolver endpoints are highly available and monitor their health proactively. Additionally, implementing network policies or redundant JWKS hosting can reduce the risk of resolver unavailability. Red Hat has also issued errata (RHSA-2026:5948 and RHSA-2026:5952) for affected downstream products (GitHub Advisory, Istio 1.28.5 Release).

The vulnerability was reported by security researcher 1seal and published by Istio maintainer dhawton via GitHub Security Advisories on March 10, 2026 (GitHub Advisory). A technical deep-dive covering this and other CVEs patched in Istio 1.30 was published on dev.to, noting the authentication bypass behavior as a significant concern for service mesh operators. Red Hat issued security errata for downstream OpenShift Service Mesh products, indicating broad ecosystem impact awareness. No significant social media controversy or widespread community alarm has been observed, consistent with the absence of active exploitation.