PT-2026-37113 · Istio · Istio

1Seal + 2 · CVE-2026-41413 · Published 2026-04-16 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.28.6 Istio versions prior to 1.29.2

Description When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without filtering localhost or link-local IP addresses. This behavior can lead to the distribution of sensitive data to Envoy proxies through the xDS configuration.

Recommendations Update to version 1.28.6. Update to version 1.29.2. Deploy a ValidatingAdmissionPolicy to prevent the creation of RequestAuthentication resources containing suspicious jwksUri field values, such as localhost, 127.0.0.0/8, 169.254.0.0/16, and their IPv6 equivalents.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41413

GHSA-FGW5-HP8F-XFHC

GO-2026-5363

Affected Products

Istio

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41413.json · Exploit
• https://github.com/istio/istio/security/advisories/GHSA-fgw5-hp8f-xfhc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgw5-hp8f-xfhc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41413 · Security Note
• https://osv.dev/vulnerability/GO-2026-5363 · Vendor Advisory
• https://github.com/istio/istio/releases/tag/1.29.2 · Note
• https://github.com/istio/istio/releases/tag/1.28.6 · Note
• https://github.com/istio/istio · Note
• https://t.me/CVEtracker/52949 · Telegram Post
• https://twitter.com/CVEnew/status/2052400812236886378 · Twitter Post
• https://t.me/cveNotify/162754 · Telegram Post