PT-2026-24488 · Istio · Istio

1Seal · Published 2026-03-10 · Updated 2026-04-01 · CVE-2026-31837

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.29.1 Istio versions prior to 1.28.5 Istio versions prior to 1.27.8

Description Istio is a platform designed for connecting, managing, and securing microservices. If the JWKS resolver becomes unavailable or a fetch operation fails, hardcoded defaults are exposed, irrespective of the RequestAuthentication resource configuration. This impacts Istio users.

Recommendations Update to Istio version 1.29.1 or later. Update to Istio version 1.28.5 or later. Update to Istio version 1.27.8 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CLEANSTART-2026-AS59691

CVE-2026-31837

GHSA-V75C-CRR9-733C

Affected Products

Istio

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31837.json · Exploit
• https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31837 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AS59691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24051 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31838 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AS59691.json · Note
• https://osv.dev/vulnerability/CVE-2026-24051 · Note
• https://osv.dev/vulnerability/ghsa-9h8m-3fm2-qjrq · Note
• https://twitter.com/CVEnew/status/2031504061447475538 · Twitter Post
• https://osv.dev/vulnerability/CVE-2026-27139 · Note