CVE-2026-39350: 
Istio Control Plane (istiod) vulnerability analysis and mitigation

CVE-2026-39350 is an incorrect regular expression vulnerability in Istio's AuthorizationPolicy that causes the serviceAccounts and notServiceAccounts fields to misinterpret dots (.) as regex wildcards rather than literal characters. This flaw affects Istio versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1. It was published on April 15, 2026, with fixes released shortly after. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified under CWE-185 (Incorrect Regular Expression), CWE-863 (Incorrect Authorization), and CWE-625 (Permissive Regular Expression). In Istio's AuthorizationPolicy, the serviceAccounts and notServiceAccounts fields accept service account names that may contain dots — a valid character in Kubernetes service account naming conventions (e.g., cert-manager.io). However, these values are evaluated as regular expressions without escaping the dot character, causing . to match any character. As a result, an ALLOW rule for cert-manager.io unintentionally grants access to cert-manager-io, cert-managerXio, and other similarly structured names, while a DENY rule for the same name fails to block those variants. Exploitation requires low privileges (an authenticated network principal) and no user interaction (GitHub Advisory).

Successful exploitation allows a low-privileged attacker to bypass Istio's authorization controls by using a service account name that matches the unintended regex pattern. ALLOW rules may grant unauthorized access to resources intended for a specific service account, while DENY rules may fail to block access from similarly named accounts. The impact is limited to confidentiality and integrity (no availability impact), but in microservice environments this could enable unauthorized service-to-service communication, data access, or lateral movement within the mesh (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. Exploitation requires low privileges — specifically, the ability to operate as or impersonate a service account with a name that matches the flawed regex pattern (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Istio deployment running a vulnerable version (1.25.0–1.27.8, 1.28.0–1.28.5, 1.29.0, or 1.29.1) and enumerate existing AuthorizationPolicy resources to find policies using serviceAccounts or notServiceAccounts fields with dot-containing names (e.g., cert-manager.io).
2. Identify target policy: Locate an ALLOW policy granting access to a specific service account such as cert-manager.io, or a DENY policy blocking a service account with a dot in its name.
3. Craft a matching service account name: Create or use a service account whose name matches the unescaped regex — for example, cert-manager-io or cert-managerXio — which satisfies the regex cert-manager.io due to the unescaped dot.
4. Exploit the authorization bypass: Authenticate to the Istio mesh using the crafted service account identity. The ALLOW rule will incorrectly permit access to protected resources, or the DENY rule will fail to block the request, granting unauthorized access to services or APIs within the mesh (GitHub Advisory).

• Logs: Istio access logs showing successful requests from service accounts with names similar to (but not exactly matching) those specified in AuthorizationPolicy rules — e.g., cert-manager-io or cert-managerXio where cert-manager.io is the intended principal.
• Configuration Audit: AuthorizationPolicy resources containing serviceAccounts or notServiceAccounts fields with dot-containing values on vulnerable Istio versions, which may indicate exposure to this flaw.
• Network: Unexpected service-to-service traffic flows within the mesh that should have been blocked by DENY policies, observable via Istio telemetry (e.g., Prometheus metrics, Kiali dashboards).

Upgrade Istio to one of the patched versions: 1.29.2, 1.28.6, or 1.27.9. No configuration-based workarounds are available according to the official advisory. After patching, administrators should audit all existing AuthorizationPolicy resources that use serviceAccounts or notServiceAccounts fields containing dots to verify that access controls are functioning as intended (GitHub Advisory).

The vulnerability was reported by a researcher credited as "Wernerina" and published by Istio maintainer keithmattix via GitHub Security Advisories. A technical blog post covering the issue was published at infinitsec.net shortly after disclosure. The Istio 1.30 release notes also reference the fix, and a dev.to article covering Istio 1.30 mentions the CVE patches. No significant broader media coverage or notable social media discussion has been identified (GitHub Advisory, Istio 1.30 Notes).