CVE-2026-41413

7.7 Élevée

Publiée le 07/05/2026 à 08:16 · Modifiée le 17/06/2026 à 12:46 · Analysée par le NVD · Source : security-advisories@github.com

Description

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.0 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N`
3.1	7.7 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/istio/istio/releases/tag/1.28.6 Release Notes
https://github.com/istio/istio/releases/tag/1.29.2 Release Notes
https://github.com/istio/istio/security/advisories/GHSA-fgw5-hp8f-xfhc MitigationVendor Advisory

CVE-2026-41413

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs