CVE-2026-39350
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS probability
- 0.21%
- CWE
- CWE-185, CWE-863
- Published
- 2026-04-15
- Last modified
- 2026-04-16
Affected products
- istio istio
- istio istio
- istio istio
Weakness type
Related vulnerabilities
- CVE-2026-73425 — @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
- CVE-2026-64655 — GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
- CVE-2026-45065 — Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- CVE-2026-56021 — Webmin information disclosure via regex pattern
- CVE-2026-47674 — Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- CVE-2026-48147 — Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
- CVE-2026-4296 — Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
- CVE-2026-25542 — Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching