Istio JWKS Resolver Failure Leading to Exposure of Hardcoded Default Keys Vulnerability

A vulnerability exists in Istio versions prior to 1.29.1, 1.28.5, and 1.27.8, where a failure in the JWKS resolver can lead to the exposure of hardcoded default keys. This issue arises regardless of the use of the RequestAuthentication resource, leaving users vulnerable when the JWKS resolver becomes unavailable or the key fetch fails.

Impact

Exploitation of this vulnerability can result in the unintended exposure of hardcoded default keys, which could be misused in authentication processes.

Remediation

Users can upgrade to Istio versions 1.29.1, 1.28.5, or 1.27.8 to address this vulnerability.