Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-41413

Опубликовано: 07 мая 2026
Источник: redhat
CVSS3: 5
EPSS Низкий

Описание

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.

A flaw was found in Istio. When a RequestAuthentication resource is created with a jwksUri (JSON Web Key Set Uniform Resource Identifier) that points to an internal service, istiod (the Istio control plane daemon) makes an unauthenticated HTTP GET request to that URL. This request does not properly filter out localhost or link-local IP addresses. Consequently, sensitive data can be inadvertently distributed to Envoy proxies via xDS (API for dynamic configuration) configuration, leading to information disclosure.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Service Mesh 2openshift-service-mesh/pilot-rhel8Not affected
OpenShift Service Mesh 2openshift-service-mesh/proxyv2-rhel9Not affected
OpenShift Service Mesh 3openshift-service-mesh/istio-proxyv2-rhel9Out of support scope

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-918
https://bugzilla.redhat.com/show_bug.cgi?id=2467646Istio: Istio: Information disclosure through unauthenticated internal service requests

EPSS

Процентиль: 25%
0.00329
Низкий

5 Medium

CVSS3

Связанные уязвимости

CVSS3: 5
nvd
3 месяца назад

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.

CVSS3: 5
github
4 месяца назад

Istio: SSRF via RequestAuthentication jwksUri

EPSS

Процентиль: 25%
0.00329
Низкий

5 Medium

CVSS3