CVE-2026-39350 PUBLISHED

Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

Assigner: GitHub_M
Reserved: 06.04.2026 Published: 15.04.2026 Updated: 16.04.2026

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor istio
Product istio
Versions
  • Version >= 1.25.0, < < 1.27.9 is affected
  • Version >= 1.28.0, < 1.28.6 is affected
  • Version >= 1.29.0, < 1.29.2 is affected

References

Problem Types

  • CWE-185: Incorrect Regular Expression CWE
  • CWE-863: Incorrect Authorization CWE