The vulnerability in Istio allows the istio control plane to perform an unauthenticated HTTP GET request to a jwksUri specified in a RequestAuthentication resource. This request is made without filtering out localhost or link‑local addresses, causing the internal service to return data that is then distributed to Envoy proxies via the xDS configuration. As a result, sensitive internal information may be exposed to unauthorized parties. The weakness is a classic SSRF flaw (CWE‑918).

Systems running Istio prior to the 1.28.6 or 1.29.2 releases are affected, including any deployment that creates RequestAuthentication resources with a jwksUri pointing to an internal service.

The CVSS score of 5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an attacker creating or modifying a RequestAuthentication resource to specify a malicious jwksUri. The attacker must have cluster‑level or privileged access to instantiate the malicious jwksUri and read internal data. The lack of external filtering allows the request to reach the internal service unimpeded, turning the data exposure into a potential breach of confidentiality for cluster developers and operators.