CVE-2026-39350: Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
Impact The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants.
Patches Fixes are available in 1.29.2, 1.28.6, and 1.27.9
Workarounds None
Other sources
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39350?
CVE-2026-39350 has been classified with a high severity level due to its potential to allow unauthorized policy bypass.
How do I fix CVE-2026-39350?
To mitigate CVE-2026-39350, you should upgrade Istio to version 1.27.9 or higher, or a subsequent stable release.
What versions are affected by CVE-2026-39350?
CVE-2026-39350 affects Istio versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, and both 1.29.0 and 1.29.1.
What type of vulnerability is CVE-2026-39350?
CVE-2026-39350 is a vulnerability in Istio's AuthorizationPolicy that results from incorrect regex matching of dots in serviceAccounts fields.
What impact does CVE-2026-39350 have on microservices?
The impact of CVE-2026-39350 is the potential for unauthorized access and policy bypass within microservices managed by Istio.