CVE-2026-39350

The record

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.

Affected packages

Related vulnerabilities

• CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-185
• CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect… CWE-185
• CVE-2026-73425 Astro is a web framework for content-driven websites. CWE-185
• CVE-2026-64655 GitHub CLI (gh) is GitHub’s official command line tool. CWE-185
• CVE-2026-56021 Webmin allows unauthenticated attackers to read the contents of any file ending in .conf… CWE-185
• GHSA-wxq7-x3qp-vcr8 Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection… CWE-185
• GHSA-xrhx-7g5j-rcj5 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CWE-185
• CVE-2026-47674 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-185