CVE-2026-41413: Istio SSRF Vulnerability via RequestAuthentication jwksUri
Summary
CVE-2026-41413: Istio: SSRF via RequestAuthentication jwksUri in istio.io/istio. Affects istio.io/istio versions < 0.0.0-20260410004459-189832a289c1. Fixed in 0.0.0-20260410004459-189832a289c1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Istio is an open-source service mesh that provides a way to control how microservices share data with one another. It offers features such as traffic management, security, and observability. The package is widely used in cloud-native applications to manage service-to-service communications. However, it has been found to be vulnerable to a Server-Side Request Forgery (SSRF) attack through the jwksUri parameter in the RequestAuthentication configuration.
Vulnerability Detail
The vulnerability arises from improper handling of the jwksUri parameter in Istio's RequestAuthentication configuration. An attacker could exploit this flaw to send crafted requests to internal services, potentially leading to unauthorized access to sensitive data or services. This SSRF vulnerability can allow attackers to bypass security controls and access internal resources that should be protected from external access.
How To Fix
Latest published version: v0.0.0-20261021223355-ac152d313bbc as of 22 Oct 2026
go get istio.io/istio@v0.0.0-20261021223355-ac152d313bbcUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20260410004459-189832a289c1
This is the first release that contains the fix.
go get istio.io/istio@v0.0.0-20260410004459-189832a289c1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the usage of the jwksUri parameter or validate the input to ensure it does not point to internal services. This can help mitigate the risk until the package is updated.
Conclusion
The SSRF vulnerability in Istio's RequestAuthentication jwksUri presents a significant risk to applications using this service mesh. It is crucial to update to the patched version to mitigate potential exploits. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in your projects.
See every vulnerability recorded for istio.io/istio →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
The potential impacts include unauthorized access to internal services, data leakage, and the ability to perform actions on behalf of the application.
Yes, a patch is available in the fixed version of Istio. Update to version 0.0.0-20260410004459-189832a289c1 to mitigate the vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the Gopkg.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for istio.io/istio.
