CVE-2026-39350 is a medium severity vulnerability in Istio, a popular open platform used to connect, manage, and secure microservices. The vulnerability impacts versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1. The issue arises from the serviceAccounts and notServiceAccounts fields in the AuthorizationPolicy where dots (.) are incorrectly interpreted as regular expression matchers. This behavior means that an ALLOW rule targeting a service account such as cert-manager.io also inadvertently matches similar names like cert-manager-io and cert-managerXio. Consequently, a DENY rule intended for the same service account name fails to block these unintended matches. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
The CVSS score for this vulnerability is 5.4, indicating a medium severity level. The risk to organizations includes potential unauthorized access due to misconfigured access controls. This vulnerability can be exploited over the network, requires low privileges, and does not necessitate user interaction for exploitation.
Given the nature of the vulnerability and its potential impact, organizations should prioritize patching immediately. It is crucial to apply updates to affected versions to mitigate the associated risks effectively. The vulnerability has been analyzed and is currently not listed in the known exploitation (KEV) catalog.
The urgency for defenders is heightened, as the vulnerability can lead to significant access control issues if left unaddressed. It is essential for security teams to evaluate their current deployments of Istio and ensure upgrades are conducted without delay.
Vulnerability Details
Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.
The CVSS score associated with this vulnerability is 5.4, which falls under the medium severity classification. This score indicates a vulnerability that could be exploited with a low level of complexity and minimal privileges required. The attack vector is network-based, and while there is low confidentiality and integrity impact, the availability impact is none.
The affected product is Istio, specifically the versions mentioned above. The vulnerability was disclosed on April 15, 2026, and has been assigned the following CWE classifications: CWE-185 (Improper Regular Expression Handling) and CWE-863 (Assignment of a Fixed Address to a Pointer).
Technical Analysis
The root cause of this vulnerability lies in the incorrect interpretation of dots in service account names within the AuthorizationPolicy configuration. Attackers may leverage this flaw to create ALLOW rules that unintentionally permit access to service accounts that should be restricted. The attack vector is network-based, and the complexity of exploitation is low, requiring only low privileges.
No user interaction is required to exploit this vulnerability, making it a pressing concern for organizations utilizing Istio in their microservices architecture. The confidentiality impact is low, as unauthorized access could potentially expose sensitive information, while the integrity impact is also low, allowing unauthorized actions without proper validation.
Risk & Impact Analysis
The real-world risk associated with CVE-2026-39350 highlights the potential for unauthorized access to microservices managed by Istio. Organizations that do not implement the necessary patches may find themselves vulnerable to attack vectors that exploit the misconfigured AuthorizationPolicy rules.
The scope of potential attacks extends to any services that utilize affected versions of Istio, thereby increasing the blast radius for organizations that rely on this technology. Given the medium CVSS score, organizations should assess their exposure and prioritize remediation efforts accordingly.
The urgency for remediation is classified as medium. Organizations should schedule fixes in their next patch cycle but should not delay beyond necessary timelines to prevent exploitation.
Exploitation Status
Signal | Status |
|---|---|
Known Exploit | No |
Public PoC | No |
Actively Exploited | No |
Ransomware Use | No |
Affected Versions
The following versions of Istio are affected by this vulnerability: 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1. Organizations should upgrade to versions 1.29.2, 1.28.6, or 1.27.9 to mitigate the risk.
Mitigation & Remediation
Patching is essential to mitigate this vulnerability. Organizations should upgrade to Istio versions 1.29.2, 1.28.6, or 1.27.9. If immediate patching is not possible, consider implementing temporary workarounds by reviewing and adjusting AuthorizationPolicy rules to avoid unintended matches. Additional configuration hardening of service accounts is also advised. Organizations may benefit from conducting a thorough review of their current security posture through penetration testing to identify similar vulnerabilities.
Detection Guidance
Organizations should monitor logs for any unusual access patterns related to service accounts. Behavioral anomalies that deviate from normal operational patterns should be investigated. Additionally, network signatures specific to Istio deployments can aid in detecting potential abuse of AuthorizationPolicy configurations.
AppSecure Threat Intelligence Insight
CVE-2026-39350 represents a significant oversight in the handling of service account names within Istio's AuthorizationPolicy. This vulnerability highlights the need for rigorous testing and validation of security policies in microservices architectures. Security teams should take this opportunity to review their configurations comprehensively, ensuring that similar issues do not arise in the future.
Moreover, the trend observed with this vulnerability emphasizes the importance of continuous security assessments. Organizations should consider implementing continuous penetration testing as part of their security strategy to proactively identify and remediate vulnerabilities.
Finally, fostering a culture of security awareness within development teams is vital. Training and awareness programs centered on secure coding practices can significantly reduce the likelihood of similar vulnerabilities in future releases.
Organizations should also stay informed about emerging vulnerabilities and trends in the security landscape to adapt their defenses accordingly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
.webp)