CVE-2026-39350

Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

State: Published
Severity: 5.4 Medium
Published: Apr 15, 2026
Updated: Apr 16, 2026
Reserved: Apr 6, 2026

Description

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-185 Incorrect Regular Expression
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
istioistio	>= 1.25.0, < < 1.27.9Affected >= 1.28.0, < 1.28.6Affected >= 1.29.0, < 1.29.2Affected

References

https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.