CVE-2026-41413 Istio Vulnerable to SSRF via RequestAuthentication jwksUri

What is CVE-2026-41413?

CVE-2026-41413 is a medium-severity server-side request forgery vulnerability in istio, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. This issue has been patched in versions 1.28.6 and 1.29.2.

Weakness: CWE-918

Which versions are affected by CVE-2026-41413?

3 open source packages ship an affected version, including istio.io/istio. It affects 1 product.

Products include Istio Istio.

How do I fix CVE-2026-41413?

Upgrade istio.io/istio to 0.0.0-20260410004459-189832a289c1 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-41413 being exploited?

There is no known exploitation of CVE-2026-41413 in the wild and no public exploit code.

Other vulnerabilities in istio

• CVE-2021-31921 Missing authorization in n/a Critical 9.8
• CVE-2021-34824 Information disclosure in n/a High 8.8
• CVE-2026-31837 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. High 8.7
• CVE-2021-39155 Authorization Policy Bypass Due to Case Insensitive Host Comparison High 8.3
• CVE-2021-39156 Fragments in Path May Lead to Authorization Policy Bypass High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fgw5-hp8f-xfhc, GO-2026-5363, MINI-25p6-8qxc-27qp, MINI-2c7p-2jcm-q97p, MINI-2h2g-6f3h-pm9h, MINI-4f98-cr4v-m376 and 14 more.