CVE-2026-41413

MEDIUM

Istio Vulnerable to SSRF via RequestAuthentication jwksUri

Title source: cna
STIX 2.1

Description

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.

References (3)

Core 3
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/istio/istio/releases/tag/1.29.2
X_Refsource_Misc x_refsource_misc
https://github.com/istio/istio/releases/tag/1.28.6

Scores

CVSS v3 5.0
EPSS 0.0033
EPSS Percentile 24.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (3)
istio/istio < 1.28.6 (2 CPE variants)
istio/istio >= 1.29.0-alpha.0, < 1.29.2
istio.io/istio 0 - 0.0.0-20260410004459-189832a289c1Go
Published May 07, 2026
Tracked Since May 07, 2026