CVE-2026-39350

[CVE catalog]

Severity

Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Published

Apr 15, 2026, 10:42:24 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 25, 2026

A flaw was found in Istio, an open platform designed to connect, manage, and secure microservices. The serviceAccounts and notServiceAccounts fields within Istio's AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. This vulnerability allows an attacker to craft service account names that can bypass intended authorization rules. As a result, an ALLOW policy may grant access to unauthorized service accounts, or a DENY policy may fail to block malicious variants, potentially leading to unauthorized access or information disclosure. Istio: github.com/istio/istio: Istio: Authorization bypass via incorrect interpretation of dots in service account names This vulnerability in Istio's AuthorizationPolicy allows for authorization bypass due to incorrect interpretation of dots in service account names. This can lead to unintended access grants or failures in blocking unauthorized service accounts. In Istio service account names may have the '.' character however the AuthorizationPolicy always interpret the '.' as in a regular expression, meaning it'll match any character between the two letters before and after the dot character. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.