Threats tagged 'ghsa-fgw5-hp8f-xfhc'

CVE-2026-41413 is a Server-Side Request Forgery (SSRF) vulnerability in Istio's RequestAuthentication resource. When a RequestAuthentication resource is configured with a jwksUri pointing to an internal service, istiod performs an unauthenticated HTTP GET request to that URL without filtering out localhost or link-local IP addresses. This can lead to sensitive data exposure to Envoy proxies via xDS configuration. Partial mitigations were released in versions 1.29.1, 1.28.5, and 1.27.8, but a more complete fix is included in versions 1.29.2 and 1.28.6. Users can also deploy a ValidatingAdmissionPolicy to block suspicious jwksUri values as a workaround.