StackRadar

CVE-2026-41413

Medium

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.0
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 1
affected package

Istio: SSRF via RequestAuthentication jwksUri

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
istio.io/istiogolangv0.0.0-20210423173126-13fb8ac89420, v0.0.0-20220218170501-5f3b5ed958ae, v0.0.0-20220606222826-f59ce19ec6b6, v0.0.0-20221007141921-b542583af7f8+14 more0.0.0-20260410004459-189832a289c122
OSV records
GHSA-fgw5-hp8f-xfhc
Also known as
GO-2026-5363

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
istio-operatorwiremindVerified publisher1.18.21 of 1See more

istio-operator wiremind 1.18.2

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/operator:1.18.270f9d1fe5fff
istio.io/istio@v0.0.0-20230721203100-0183f2886bc0
0.0.0-20260410004459-189832a289c1

Open the chart page →

5,630
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/proxyv2:1.14.1df69c1a7af7c
istio.io/istio@v0.0.0-20220606222826-f59ce19ec6b6
0.0.0-20260410004459-189832a289c1

Open the chart page →

96,941
istio-allcode4devsVerified publisher1.2.02 of 6See more

istio-all code4devs 1.2.0

2 of the 6 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1

Open the chart page →

4,784
istio-control-planecode4devsVerified publisher1.0.02 of 3See more

istio-control-plane code4devs 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1

Open the chart page →

2,360
htnn-controllerhtnnVerified publisher0.5.01 of 1See more

htnn-controller htnn 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
istio.io/istio@v0.0.0-20240601203759-7f26a100ece0
0.0.0-20260410004459-189832a289c1

Open the chart page →

4,300
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.29.1f8b0e412ac4a
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc
0.0.0-20260410004459-189832a289c1

Open the chart page →

11,574
istio-discoveryaveshaVerified publisher1.16.01 of 1See more

istio-discovery avesha 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.16.0ac0284d75ec9
istio.io/istio@v0.0.0-20221111170945-8f2e2dc5d57f
0.0.0-20260410004459-189832a289c1

Open the chart page →

6,908
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
istio.io/istio@v0.0.0-20251127165946-6268e25f089a+dirty
0.0.0-20260410004459-189832a289c1

Open the chart page →

22,193
istio-aws-private-ingress-customizedistio-aws-private-ingress-customized1.0.01 of 1See more

istio-aws-private-ingress-customized istio-aws-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
istio.io/istio@v0.0.0-20230607011503-697f4ff0fe6e
0.0.0-20260410004459-189832a289c1

Open the chart page →

5,530
istio-azure-private-ingress-customizedistio-azure-private-ingress-customized1.0.01 of 1See more

istio-azure-private-ingress-customized istio-azure-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
istio.io/istio@v0.0.0-20230607011503-697f4ff0fe6e
0.0.0-20260410004459-189832a289c1

Open the chart page →

5,530
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc+dirty
0.0.0-20260410004459-189832a289c1

Open the chart page →

2,900
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.15.2db08d6963975
istio.io/istio@v0.0.0-20221007141921-b542583af7f8
0.0.0-20260410004459-189832a289c1

Open the chart page →

19,168
kubebbkubebb0.0.11 of 1See more

kubebb kubebb 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
kubebb/core:lateste366c34a9b8d
istio.io/istio@v0.0.0-20230403171433-e6124efb9305
0.0.0-20260410004459-189832a289c1

Open the chart page →

1,749
kubebb-corekubebb0.1.271 of 1See more

kubebb-core kubebb 0.1.27

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
kubebb/core:v0.1.62b9e7f451d6b
istio.io/istio@v0.0.0-20230403171433-e6124efb9305
0.0.0-20260410004459-189832a289c1

Open the chart page →

1,938
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
kubebb/mesh-operator:v5.7.0163ebbfc7a82
istio.io/istio@v0.0.0-20230719200609-00136097767e
0.0.0-20260410004459-189832a289c1

Open the chart page →

6,490
istio-helm-cnimesosphere1.25.11 of 1See more

istio-helm-cni mesosphere 1.25.1

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/install-cni:1.29.0ce27c9ce43c8
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260410004459-189832a289c1

Open the chart page →

2,533
istio-helm-istiodmesosphere1.25.11 of 2See more

istio-helm-istiod mesosphere 1.25.1

1 of the 2 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.29.0325156535773
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260410004459-189832a289c1

Open the chart page →

3,777
istio-helm-cnimesosphere-stable1.23.61 of 1See more

istio-helm-cni mesosphere-stable 1.23.6

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/install-cni:1.23.6ab34c4740f44
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260410004459-189832a289c1

Open the chart page →

3,283
istio-helm-istiodmesosphere-stable1.23.61 of 2See more

istio-helm-istiod mesosphere-stable 1.23.6

1 of the 2 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.23.69c3d6a218181
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260410004459-189832a289c1

Open the chart page →

4,603
multicluster-meshocm-helm-chartsVerified publisher0.0.21 of 1See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
istio.io/istio@v0.0.0-20220218170501-5f3b5ed958ae
0.0.0-20260410004459-189832a289c1

Open the chart page →

2,124
istio-operatorparticuleio1.7.01 of 1See more

istio-operator particuleio 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
gcr.io/istio-testing/operator:latest8d4576f7b98f
istio.io/istio@v0.0.0-20240729203234-a5447357907e
0.0.0-20260410004459-189832a289c1

Open the chart page →

4,120
gloo-meshsolo-gloo-mesh1.1.21 of 1See more

gloo-mesh solo-gloo-mesh 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
istio.io/istio@v0.0.0-20210423173126-13fb8ac89420
0.0.0-20260410004459-189832a289c1

Open the chart page →

3,257
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41413.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
istio.io/istio@v0.0.0-20230222092740-7d6d2adacf8d
0.0.0-20260410004459-189832a289c1

Open the chart page →

6,232

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
istio/install-cni:1.24.2-distrolessaef4825e110f
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1
2
istio/pilot:1.24.2-distroless137e44e3d1d2
istio.io/istio@v0.0.0-20241214032803-7754674f65d3
0.0.0-20260410004459-189832a289c1
2
istio/proxyv2:1.18.0757d28c24100
istio.io/istio@v0.0.0-20230607011503-697f4ff0fe6e
0.0.0-20260410004459-189832a289c1
2
istio/install-cni:1.23.6ab34c4740f44
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260410004459-189832a289c1
1
istio/install-cni:1.29.0ce27c9ce43c8
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260410004459-189832a289c1
1
istio/operator:1.18.270f9d1fe5fff
istio.io/istio@v0.0.0-20230721203100-0183f2886bc0
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.29.0325156535773
istio.io/istio@v0.0.0-20260211003324-2300e2458ab7
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.23.69c3d6a218181
istio.io/istio@v0.0.0-20250403050546-6a112a284106
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.16.0ac0284d75ec9
istio.io/istio@v0.0.0-20221111170945-8f2e2dc5d57f
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.17.1ce9d87606701
istio.io/istio@v0.0.0-20230222092740-7d6d2adacf8d
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.15.2db08d6963975
istio.io/istio@v0.0.0-20221007141921-b542583af7f8
0.0.0-20260410004459-189832a289c1
1
istio/pilot:1.29.1f8b0e412ac4a
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc
0.0.0-20260410004459-189832a289c1
1
istio/proxyv2:1.14.1df69c1a7af7c
istio.io/istio@v0.0.0-20220606222826-f59ce19ec6b6
0.0.0-20260410004459-189832a289c1
1
kubebb/core:v0.1.62b9e7f451d6b
istio.io/istio@v0.0.0-20230403171433-e6124efb9305
0.0.0-20260410004459-189832a289c1
1
kubebb/core:lateste366c34a9b8d
istio.io/istio@v0.0.0-20230403171433-e6124efb9305
0.0.0-20260410004459-189832a289c1
1
kubebb/mesh-operator:v5.7.0163ebbfc7a82
istio.io/istio@v0.0.0-20230719200609-00136097767e
0.0.0-20260410004459-189832a289c1
1
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
istio.io/istio@v0.0.0-20210423173126-13fb8ac89420
0.0.0-20260410004459-189832a289c1
1
gcr.io/istio-testing/operator:latest8d4576f7b98f
istio.io/istio@v0.0.0-20240729203234-a5447357907e
0.0.0-20260410004459-189832a289c1
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
istio.io/istio@v0.0.0-20260306174214-6991a379e1fc+dirty
0.0.0-20260410004459-189832a289c1
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
istio.io/istio@v0.0.0-20251127165946-6268e25f089a+dirty
0.0.0-20260410004459-189832a289c1
1
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
istio.io/istio@v0.0.0-20240601203759-7f26a100ece0
0.0.0-20260410004459-189832a289c1
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
istio.io/istio@v0.0.0-20220218170501-5f3b5ed958ae
0.0.0-20260410004459-189832a289c1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.