CVE-2026-39350: Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
### Impact The `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy incorrectly interpret dots (`.`) as a regular expression matcher. Because `.` is a valid character in a service account name, an `AuthorizationPolicy` ALLOW rule targeting SA e.g. `cert-manager.io` also matches `cert-manager-io`, `cert-managerXio`, etc. A DENY rule targeting the same name fails to block those variants. ### Patches Fixes are available in 1.29.2, 1.28.6, and 1.27.9 ### Workarounds None
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39350?
CVE-2026-39350 has been classified with a high severity level due to its potential to allow unauthorized policy bypass.
How do I fix CVE-2026-39350?
To mitigate CVE-2026-39350, you should upgrade Istio to version 1.27.9 or higher, or a subsequent stable release.
What versions are affected by CVE-2026-39350?
CVE-2026-39350 affects Istio versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, and both 1.29.0 and 1.29.1.
What type of vulnerability is CVE-2026-39350?
CVE-2026-39350 is a vulnerability in Istio's AuthorizationPolicy that results from incorrect regex matching of dots in serviceAccounts fields.
What impact does CVE-2026-39350 have on microservices?
The impact of CVE-2026-39350 is the potential for unauthorized access and policy bypass within microservices managed by Istio.