# CVE-2026-31836: Istio authentication bypass or access control vulnerability

Source: https://junglewise.ai/threats/cve-2026-31836-gcp-2026-080  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-31836 · Severity: high · Published 2026-11-09

Istio is a service mesh that manages traffic and security between containerized applications. A vulnerability in Istio could allow attackers to bypass authentication or access controls, potentially gaining unauthorized access to services or intercepting traffic within a Kubernetes cluster.

Technologies: [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-31836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31836 being exploited in the wild.

**How severe is CVE-2026-31836?** High severity, published 9 November 2026.

**Which products and versions are affected?** Istio.

**Is there a fix for CVE-2026-31836?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31836 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-31836?** Check whether you run Google Cloud Platform or Istio. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-31836 affects Istio, a service mesh for Kubernetes environments. The vulnerability class and attack vector are not specified in the advisory, but given the service mesh context, it likely affects request routing or authentication enforcement. An attacker with network access to Istio components or services could exploit this to bypass security policies, though specific preconditions are not detailed in this bulletin.

## Affected products

- Istio

## Timeline

- 2026-11-09: advisory

## References

- [https://docs.cloud.google.com/support/bulletins/index](https://docs.cloud.google.com/support/bulletins/index)

## Related threats

- [AMD EPYC 5th generation processor data cache information leak](https://junglewise.ai/threats/cve-2024-36350-gcp-2026-081)
- [Slurm multiple vulnerabilities in Cluster Toolkit](https://junglewise.ai/threats/cve-2026-65107-slurm-sbcast-shared-library-validation-bypass)
- [Google Application Integration deserialization of untrusted data in SubWorkflow](https://junglewise.ai/threats/cve-2026-93327-gcp-2026-074)
- [Google Compute Engine incorrect authorization in disk access](https://junglewise.ai/threats/cve-2026-85299-gcp-2026-073)
- [Google Brotli buffer overflow in decoder](https://junglewise.ai/threats/cve-2026-111497-a-buffer-overflow-vulnerability-in-the-brotli-decoder-c-dec)