PT-2026-33182 · Istio · Istio

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-39350

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Istio versions 1.25.0 through 1.27.8 Istio versions 1.28.0 through 1.28.5 Istio versions 1.29.0 through 1.29.1

Description In the AuthorizationPolicy, the serviceAccounts and notServiceAccounts fields incorrectly interpret dots (.) as regular expression matchers. Since dots are valid characters in service account names, an ALLOW rule targeting a specific account, such as 'cert-manager.io', will also match unintended variants like 'cert-manager-io' or 'cert-managerXio'. Conversely, a DENY rule targeting the same name will fail to block these variants.

Recommendations Update to version 1.27.9 for versions 1.25.0 through 1.27.8. Update to version 1.28.6 for versions 1.28.0 through 1.28.5. Update to version 1.29.2 for versions 1.29.0 through 1.29.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-185

CWE-863

Related Identifiers

CVE-2026-39350

GHSA-9GCG-W975-3RJH

Affected Products

Istio

References · 7

• https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gcg-w975-3rjh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39350 · Security Note
• https://github.com/istio/istio · Note
• https://github.com/istio/istio/commit/692e460c342d8f308a35b6ecbdace47807da8ade · Note
• https://twitter.com/VulmonFeeds/status/2044681951571804654 · Twitter Post
• https://twitter.com/CVEnew/status/2044701606504223179 · Twitter Post