The Istio service mesh contains a flaw in its JWT Web Key Set (JWKS) resolver. When the resolver is unable to fetch the key set from the configured provider, it falls back to hard‑coded default data that includes private key material. An attacker who can trigger a fetch failure and access the fallback output could obtain these private keys, thereby compromising the confidentiality of the service mesh and potentially enabling credential theft or impersonation. This bug is a form of information disclosure (CWE‑200) and is exacerbated by the fact that it can occur even when a RequestAuthentication resource is in place.

The affected vendor is Istio, the product Istio, and all releases prior to 1.29.1, 1.28.5, and 1.27.8 are impacted. In other words, any Istio 1.28.x series before 1.28.5, any 1.27.x series before 1.27.8, and any 1.29.x series before 1.29.1 are vulnerable. Upgrading to the fixed releases or any newer version resolves the issue.

The CVSS vector scores this vulnerability at 8.7, marking it as high severity. The EPSS score is less than 1 %, indicating that the likelihood of exploitation in the wild is low, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. However, the potential exposure of hard‑coded private keys makes the impact severe enough that it should be mitigated even if the probability is low. The likely attack vector is an environment that can force the JWKS resolver to fail—such as a network partition, misconfigured key provider, or denial‑of‑service attempt—after which the fallback data can be read by any component involved in processing the authentication flow. Because the flaw is triggered by a failure condition, it is important to confirm that proper error handling and monitoring are in place.