Medium severity · published Apr 15, 2026
CVE-2026-39350
Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
istio · istio
>= 1.25.0, < < 1.27.9; >= 1.28.0, < 1.28.6; >= 1.29.0, < 1.29.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39350
Vendor Advisory
https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh
More from istio
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2022-31045
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2022-21679
Istio is an open platform to connect, manage, and secure microservices
9.8
CVE-2021-31921
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing…
8.8
CVE-2022-21701
Istio is an open platform to connect, manage, and secure microservices