Log in Start free

Vulnerability · Published Apr 15, 2026 · Assigned by GitHub_M

CVE-2026-39350Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

Medium 5.4

In plain English

A medium-severity incorrect authorization in istio from istio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 88.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Goistio.io/istio0.0.0-20260403004500-692e460c342dGHSA-9gcg-w975-3rjh
Goistio.io/istio0.0.0-20260403004500-692e460c342dGO-2026-5289

Affected products (as reported)

VendorProductVersions
istio istio >= 1.25.0, < < 1.27.9>= 1.28.0, < 1.28.6>= 1.29.0, < 1.29.2

Weakness: CWE-185, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References