Skip to content
Fencer Vulns
high 7.5

CVE-2026-31837 json

Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

published 2026-03-10 8 mo ago modified 2026-07-20 3 mo ago also EUVD-2026-10938

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

Patch / fix

  • Red Hat Red Hat OpenShift AI 2.25 1776343082, 1776343105, 1776343121
  • Red Hat Red Hat OpenShift Service Mesh 3.0 1774006090, 1774068855
  • Red Hat Red Hat OpenShift Service Mesh 3.1 1774037369, 1774244136
  • Red Hat Red Hat OpenShift Service Mesh 3.2 1774114903, 1774206464

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31837 updated cvss 7.5

istio: Istio: Information disclosure and authentication bypass via JWKS resolver unavailability

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-istio-csr-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/net-istio-webhook-rhel9, openshift-serverless-1/net-istio-controller-rhel9, openshift-serverless-1/serverless-kn-operator-rhel9, openshift-serverless-1/kn-eventing-istio-controller-rhel9, openshift-serverless-1/serverless-openshift-kn-rhel9-operator Red Hat OpenShift AI (RHOAI) rhoai/odh-model-controller-rhel8, rhoai/odh-model-controller-rhel9, rhoai/odh-model-registry-operator-rhel9
    affected: no fix available
  • Red Hat OpenShift AI 2.25 rhoai 1776343082, rhoai 1776343105, rhoai 1776343121
    fixed: vendor fix RHSA-2026:10184
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 1774006090, openshift-service-mesh 1774068855
    fixed: vendor fix RHSA-2026:5948
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh 1774037369, openshift-service-mesh 1774244136
    fixed: vendor fix RHSA-2026:5950
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh 1774114903, openshift-service-mesh 1774206464
    fixed: vendor fix RHSA-2026:5952
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-operator-bundle, cert-manager/jetstack-cert-manager-acmesolver-rhel9
    not affected: vulnerable code not present
  • Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat Ansible Automation Platform 2 automation-gateway-proxy, automation-gateway-proxy-openssl30, automation-gateway-proxy-openssl32 Red Hat Connectivity Link 1 rhcl-1/rhcl-rhel9-operator, rhcl-1/rhcl-operator-bundle
    not affected: vulnerable code not present
show 2 more
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9, rhoai/odh-notebook-controller-rhel8, rhoai/odh-kf-notebook-controller-rhel8, rhoai/odh-model-registry-operator-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 2.25 rhoai 1775144403, rhoai 1776243157, rhoai 1776243163, rhoai 1776243192, rhoai 1776243217, rhoai 1776243229, +68 more Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh 1774018912, openshift-service-mesh 1774214116, openshift-service-mesh 1774294372, openshift-service-mesh 1774302863, openshift-service-mesh-dev-preview-beta 1774019474 Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh 1774037182, openshift-service-mesh 1774037349, openshift-service-mesh 1774293851, openshift-service-mesh 1774299519, openshift-service-mesh-tech-preview 1774215103 Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh 1774024187, openshift-service-mesh 1774206585, openshift-service-mesh 1774207172, openshift-service-mesh 1774294809, openshift-service-mesh 1774299791
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • istio istio
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat cert-manager Operator for Red Hat OpenShift
  • Red Hat ExternalDNS Operator
  • Red Hat OpenShift Serverless
  • Red Hat OpenShift Service Mesh 2
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Connectivity Link 1
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-1392 Use of Default Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.